What a reason to keep verification file into repository ?

[VovaStelmashchuk]

I try to setup the project locally and project cannot be build, because the few checksums are incorrect. I was just delete the verification-metadata.xml and the problem solved.

What a reason keep the verification metadata file into the project ?

[ionspin]

Hi @VovaStelmashchuk,

Having verification-metadata.xml enables Gradle dependency verification, you can learn more about it here (https://docs.gradle.org/current/userguide/dependency_verification.html). In general it should fail if a binary that is used as dependency has an invalid signature, or in case if there is no signature a checksum/hash, this is a protection from a malicious actor replacing the binary that your project is importing with a modified binary.

The other case where it might fail if there is a new dependency that is not in the list yet, which I believe you might be seeing.

You can run
./gradlew --write-verification-metadata pgp,sha256 help
to see what changes gradle would suggest, and then if they make sense and you trust it you could add those changes to the verification-metadata.xml file.

[VovaStelmashchuk]

I execute the command, and the file changed. Do exists any reason for create MR with this changes ?

[ionspin]

Not really, as long as the CI is successfully building the library we don't have to change it. But to be honest I am curious which dependencies were causing the issue, could you share the resulting xml diff here?

The reason I am asking is, the CI builds the library on Linux, Mac and Windows, so if there are any failures, I should be seeing the CI build fail, and currently it's working fine (although the CI is still running with the latest pull request that was merged, the one you submitted).

[VovaStelmashchuk]

verification.diff.txt

[VovaStelmashchuk]

Surre, I uploaded the diff file. The file has a .txt extension, because github doesn't allow to upload .diff.

[ionspin]

Awesome, thanks!