sakshichitnis27 opened a new pull request, #6740:
URL: https://github.com/apache/jmeter/pull/6740
## Summary
- Add the AutoStyle 4.0.1 release key to Gradle's checked-in dependency
verification keyring.
- Keep signature verification enabled while allowing builds to verify
AutoStyle artifacts without reaching an external key server.
## Background
JMeter's verification metadata already trusts AutoStyle fingerprint
`6FF955169D698CC09BA7403AC99BFE8CD562EAC1`, but the corresponding public key
was not present in `gradle/verification-keyring.keys`.
When the configured public key servers are unavailable, Gradle cannot verify
the
AutoStyle 4.0.1 metadata used by the build logic. This stops the build during
`:build-logic:build-parameters:compileJava` before JMeter itself can be
compiled.
This change adds only that public key to the local keyring. It does not
disable
dependency verification, ignore the signing key, change a dependency
version, or
add a checksum exception.
## Verification
- Reproduced the failure with external key servers disabled: the same five
AutoStyle 4.0.1 artifacts failed verification.
- Verified all eight downloaded AutoStyle 4.0.1 signatures independently
against
fingerprint `6FF955169D698CC09BA7403AC99BFE8CD562EAC1`.
- Repeated the restricted-key-server build after adding the key; the build
configuration completed successfully.
- Ran `./gradlew --quiet check -PjdkTestVersion=21`.
- Ran `./gradlew --quiet :src:dist:assemble -PjdkTestVersion=21`.
- Verified the generated binary ZIP with `unzip -t`.
Refs #6713
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
