Comments (6)
bigdaz
commented on August 27, 2024
1
Oops. "Preview" in GitHub doesn't auto-commit :)...
from github-dependency-graph-gradle-plugin.
bigdaz
commented on August 27, 2024
Thanks for the report. The PGP key used for signing was rotated for the 0.4.1 release, and the new key should have been used for all subsequent releases. The signing process is automated, and I don't understand why the old key was used to sign the 1.0.0 release yesterday.
I'll look into it.
from github-dependency-graph-gradle-plugin.
aibaars
commented on August 27, 2024
When running this plugin on a bunch of open source repositories, I used -Dorg.gradle.dependency.verification=off as a workaround . It may work for you, but it disables the verification for all dependencies, so use with care.
from github-dependency-graph-gradle-plugin.
illarionov
commented on August 27, 2024
Now I add both keys to the trusted-keys list:
<trusted-keys>
<trusted-key id="314FE82E5A4C5377BCA2EDEC5208812E1E4A6DB0">
<trusting group="com.gradle" name="gradle-enterprise-gradle-plugin"/>
<trusting group="org.gradle" name="github-dependency-graph-gradle-plugin"/>
</trusted-key>
<trusted-key id="7B79ADD11F8A779FE90FD3D0893A028475557671">
<trusting group="com.gradle" name="gradle-enterprise-gradle-plugin"/>
<trusting group="org.gradle" name="github-dependency-graph-gradle-plugin"/>
</trusted-key>
</trusted-keys>This works, but I had doubts about the correctness of this approach due to key changes
from github-dependency-graph-gradle-plugin.
bigdaz
commented on August 27, 2024
I'm confused. Using --write-verification-metadata pgp,sha256 seems to generate the correct dependency-verification.xml file when this plugin is loaded via an init-script.
The trusted key used with all versions from 1.0.0 onward is 7B79ADD11F8A779FE90FD3D0893A028475557671.
I've added a short section to the README about this.
from github-dependency-graph-gradle-plugin.
illarionov
commented on August 27, 2024
Looks like this section got lost somewhere? I can't find it in the README.
from github-dependency-graph-gradle-plugin.
Related Issues (20)
- Port to kotlinx-serialization HOT 10
- handleBuildOperationTypeRaw masks failed build operations HOT 3
- `ForceDependencyResolutionPlugin` incompatible with Project isolation HOT 2
- Include Gradle version in generated dependency graph
- Exclude plugin marker dependencies from generated graph
- Exclude the github-dependency-graph-gradle-plugin from the generated graph HOT 1
- Log each resolved dependency and associated configuration path
- Incomplete dependency-graph generated on build failure
- Excluded configurations should not be resolved
- Locked and non-resolving configurations fail with an error in Gradle 7.x with a single project HOT 1
- Stale dependencies in Dependency graph HOT 8
- DependencyExtractorBuildService$Inject cannot be cast to class org.gradle.dependencygraph.extractor.DependencyExtractor HOT 3
- Failed to stop service 'gitHubDependencyExtractorService' HOT 3
- Error message on missing required input param prompts user to "Please report this issue"
- gradle jvm toolchain support HOT 2
- SimpleDependencyGraphPlugin does not capture plugin dependencies HOT 11
- Failures during dependency resolution seem to be swallowed HOT 3
- Circular dependency error when build includes itself HOT 8
- Annotate PRs that merging will resolve or introduce Dependabot alert HOT 3
- Plugin doesn't seem to work with projects that use `dependencyResolutionManagement` HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from github-dependency-graph-gradle-plugin.