Publish the library to a public repository about memorizingtrustmanager HOT 5 OPEN

Any update on this, please?

from memorizingtrustmanager.

As a workaround, you should be able to use https://jitpack.io/

from memorizingtrustmanager.

I really discourage using jitpack.io. It's a security nightmare. You can't verify that the artifacts are authentic.

Including MTM in you Android projects as git submodule, which is really easy, is currently the only way to ensure that it's authentic.

from memorizingtrustmanager.

@Flowdalic you could use gralde-witness to lock down the hash of the build, and then link against a specific revision using Jitpack. (Or does the hash change on jitpack for every build?)

But you're probably right, Submodules are probably the better solution (even though they're a pain to use properly with multiple contributors).

from memorizingtrustmanager.

@Flowdalic you could use gralde-witness to lock down the hash of the build, and then link against a specific revision using Jitpack. (Or does the hash change on jitpack for every build?)

Yes gradle-witness (or the alternatives mentioned in http://stackoverflow.com/a/34795359/194894) would help, given that Jitpack doesn't change the hash for stable artifacts.

I find submodules preferable and easy to use (even with multiple contributors). Compared to consume the dependency as artifact, they allow you to directly make changes to the code and easily upstream it.

from memorizingtrustmanager.