It is critically important that new jars do not become part of the runtime distribution of a mainnet node unintentionally. We should have a file in the system (maybe part of build.gradle.kts) that will verify the exact names of jars and their hashes in the built output. Whenever the jar files are modified, we should also update this file and verify the hashes and everything are exactly what we expect.
It is critically important that new jars do not become part of the runtime distribution of a mainnet node unintentionally. We should have a file in the system (maybe part of
build.gradle.kts
) that will verify the exact names of jars and their hashes in the built output. Whenever the jar files are modified, we should also update this file and verify the hashes and everything are exactly what we expect.