Review/support upcoming dependency verification in Gradle 6.2

Gradle 6.2 will have integrated dependency verification for integrity and provenance.

Issue: https://github.com/gradle/gradle/issues/10443 Documentation PR: https://github.com/gradle/gradle/pull/11755

Note: as Gradle would switch to “verify all resolutions”, it would effectively prevent the operation of gradle-versions-plugin.

It looks like there will be ResolutionStrategy#disableDependencyVerification() API to temporary disable the verification.

Do you think that would be OK for G-V-P?

[vlsi]

@anuraaga , it is not enabled by default. It is activated by the presence of gradle/verification-metadata.xml file.

For instance, if you launch Gradle with --write-verification-metadata it will create a file. Then all subsequent Gradle executions would verify the dependencies and deny the resolution of unresolved ones.

[ben-manes]

Thanks for the heads up. If we use Groovy’s obj.metaClass.respondsTo to reflectively check for that method, it could be added in a backwards compatible fashion.