[ https://issues.apache.org/jira/browse/OFBIZ-12186?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17292162#comment-17292162 ]
ASF subversion and git services commented on OFBIZ-12186: --------------------------------------------------------- Commit 99d26d986ab329c822871b961b1af3788406010f in ofbiz-framework's branch refs/heads/trunk from Jacques Le Roux [ https://gitbox.apache.org/repos/asf?p=ofbiz-framework.git;h=99d26d9 ] Improved: Dependency verification (OFBIZ-12186) It does not work on Buildbot, not sure why yet. Better to not use it for now... To deactivate, you don't need to change the <verify-... elements but the file name > Dependency verification > ------------------------ > > Key: OFBIZ-12186 > URL: https://issues.apache.org/jira/browse/OFBIZ-12186 > Project: OFBiz > Issue Type: Sub-task > Components: Gradle > Affects Versions: Trunk > Reporter: Jacques Le Roux > Priority: Major > Attachments: verification-metadata.xml > > > I posted a related message in dev ML: > https://markmail.org/message/55r5ycn2wrbotnbn: > {quote} > Hi, > I just read a members thread about this article: > https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 > One member mentioned that the Groovy project is using the Gradle's dependency > verification feature\[1] in the Apache Groovy build. > I suggest we do the same, even after the move from JCenter to MavenCentral > where things should be safer. > What do you think? > \[1] https://docs.gradle.org/current/userguide/dependency_verification.html > Jacques > {quote} > Note that dependency verification is an incubating feature. So we will wait > before backporting from trunk... -- This message was sent by Atlassian Jira (v8.3.4#803005)