Dependency verification: pin sources/javadoc jars of the two hash-pinned groups #131
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
IDE sources download failed verification: io.github.willena:sqlite-jdbc:3.50.1.0-sources.jar is outside the D20 trust rule and had no recorded hash — only the main jars of the two pinned groups (io.github.willena, net.zetetic) were listed in gradle/verification-metadata.xml. Fix: sha256 entries added for the sources and javadoc jars of both components, hashed locally from Maven Central and cross-checked against Central's own .sha1 files. Verified: an ArtifactResolutionQuery for SourcesArtifact/JavadocArtifact of both modules resolves all four through verification.