[OFBIZ-12186] Dependency verification

• Type: Sub-task
• Status: Closed
• Priority: Major
• Resolution: Abandoned
• Affects Version/s: Trunk, Upcoming Branch
• Component/s: Gradle
• Sprint: Bug Crush Event - 21/2/2015
• Assignee: Jacques Le Roux
• Reporter: Jacques Le Roux
• Created: 22/Feb/21 12:46
• Updated: 29/Feb/24 16:09
• Resolved: 22/Apr/23 08:56

Description

I posted a related message in dev ML: https://markmail.org/message/55r5ycn2wrbotnbn:

Hi,

I just read a members thread about this article: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

One member mentioned that the Groovy project is using the Gradle's dependency verification feature[1] in the Apache Groovy build.

I suggest we do the same, even after the move from JCenter to MavenCentral where things should be safer.

What do you think?

[1] https://docs.gradle.org/current/userguide/dependency_verification.html

Jacques

Note that dependency verification is an incubating feature. So we will wait before backporting from trunk...