signalapp / gradle-witness

A gradle plugin that enables static verification for remote dependencies.
MIT License
228 stars 60 forks source link

Use full artifact version during verification #6

Open tinarm opened 9 years ago

tinarm commented 9 years ago

This solves a problem when transitive dependencies ends up with the same name. Before this commit the following dependencies resulted in a verifcation error:

Main dep:

Transitive deps:

In this case the dependencyVerification list had three entries containing the name 'foo-platform' with different checksums. This resulted in a conflict during verification.

This commit makes use of all the info that follows the name to find the exact dependency, e.g. '1.0.0-linux' in this example.