search

kagkarlsson / db-scheduler

Persistent cluster-friendly scheduler for Java
Apache License 2.0
1.23k stars 188 forks source link

PGP signature on Maven Central seems to be incompatible with current Gradle/bouncycastle versions #518

Open cseewald opened 1 month ago

cseewald commented 1 month ago

Expected Behavior

I would like to be able to verify db-scheduler.jar with Gradle Dependency Verification with the PGP signature on Maven Central.

Current Behavior

If I enable dependency verification (https://docs.gradle.org/8.5/userguide/dependency_verification.html) I get an exception in the gradle build which hints at a broken/incompatible PGP signature.

class org.bouncycastle.openpgp.PGPCompressedData cannot be cast to class org.bouncycastle.openpgp.PGPSignatureList (org.bouncycastle.openpgp.PGPCompressedData and org.bouncycastle.openpgp.PGPSignatureList are in unnamed module of loader org.gradle.initialization.MixInLegacyTypesClassLoader @15a04efb)

The error is only reported if db-scheduler is added as a dependency and only if it is version >= 12.0.1.

See https://github.com/cseewald/db-scheduler-client

Context