search

smarkwal / jarhc

JarHC - JAR Health Check
Apache License 2.0
8 stars 0 forks source link

Build: Verify dependencies #106

Open smarkwal opened 2 years ago

smarkwal commented 2 years ago

See https://docs.gradle.org/current/userguide/dependency_verification.html

Open question: Is Dependabot able to detect a verification-metadata.xml file and update it automatically? Or will all builds on branches created by Debendabot fail because of missing checksums?

smarkwal commented 2 years ago

Problem 1: Verification fails when running in GitHub workflow

Build log:

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':compileTestJava'.
> Dependency verification failed for configuration ':testCompileClasspath':
    - On artifact apiguardian-api-1.1.2.module (org.apiguardian:apiguardian-api:1.1.2) in repository 'maven': checksum is missing from verification metadata.
    - On artifact junit-bom-5.8.2.module (org.junit:junit-bom:5.8.2) in repository 'maven': checksum is missing from verification metadata.
    - On artifact junit-jupiter-5.8.2.module (org.junit.jupiter:junit-jupiter:5.8.2) in repository 'maven': checksum is missing from verification metadata.
    - On artifact junit-jupiter-api-5.8.2.module (org.junit.jupiter:junit-jupiter-api:5.8.2) in repository 'maven': checksum is missing from verification metadata.
    - On artifact junit-jupiter-params-5.8.2.module (org.junit.jupiter:junit-jupiter-params:5.8.2) in repository 'maven': checksum is missing from verification metadata.
    - On artifact junit-platform-commons-1.8.2.module (org.junit.platform:junit-platform-commons:1.8.2) in repository 'maven': checksum is missing from verification metadata.

  If the artifacts are trustworthy, you will need to update the gradle/verification-metadata.xml file by following the instructions at https://docs.gradle.org/7.3.3/userguide/dependency_verification.html#sec:troubleshooting-verification

  These files failed verification:
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.apiguardian/apiguardian-api/1.1.2/3926494c1a91787100e2ad2dac7436cb444b85a6/apiguardian-api-1.1.2.module
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.junit.jupiter/junit-jupiter-api/5.8.2/a018e517b9ed8ea18e9e9f54e310f6a7db524249/junit-jupiter-api-5.8.2.module
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.junit.jupiter/junit-jupiter-params/5.8.2/3e066ae02a1a24135e34eaf6ee333e48140d01ee/junit-jupiter-params-5.8.2.module
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.junit.jupiter/junit-jupiter/5.8.2/9c350c0f880fce38cd2a52ebccc439f6466d8fbd/junit-jupiter-5.8.2.module
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.junit.platform/junit-platform-commons/1.8.2/14da3265fd8116e0a99e857739e5ae15a88d06d9/junit-platform-commons-1.8.2.module
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.junit/junit-bom/5.8.2/45baa4e4f23ac98450a5dcc757be838267387c3/junit-bom-5.8.2.module

  GRADLE_USER_HOME = /home/runner/.gradle

  These files failed verification:
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.apiguardian/apiguardian-api/1.1.2/3926494c1a91787100e2ad2dac7436cb444b85a6/apiguardian-api-1.1.2.module
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.junit.jupiter/junit-jupiter-api/5.8.2/a018e517b9ed8ea18e9e9f54e310f6a7db524249/junit-jupiter-api-5.8.2.module
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.junit.jupiter/junit-jupiter-params/5.8.2/3e066ae02a1a24135e34eaf6ee333e48140d01ee/junit-jupiter-params-5.8.2.module
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.junit.jupiter/junit-jupiter/5.8.2/9c350c0f880fce38cd2a52ebccc439f6466d8fbd/junit-jupiter-5.8.2.module
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.junit.platform/junit-platform-commons/1.8.2/14da3265fd8116e0a99e857739e5ae15a88d06d9/junit-platform-commons-1.8.2.module
    - GRADLE_USER_HOME/caches/modules-2/files-2.1/org.junit/junit-bom/5.8.2/45baa4e4f23ac98450a5dcc757be838267387c3/junit-bom-5.8.2.module

  GRADLE_USER_HOME = /home/runner/.gradle

  Open this report for more details: file:///home/runner/work/jarhc/jarhc/build/reports/dependency-verification/at-1641728001943/dependency-verification-report.html

Source: https://github.com/smarkwal/jarhc/actions/runs/1673776620

reports.zip

Problem 2: Verification fails when loading Gradle project in IntelliJ

IntelliJ issues:

reports2.zip