Repository navigation
Remove the pinned dependency digest check - #26
Merged
Merged
Conversation
The shaded modules checked their embedded libraries against SHA-256 digests pinned by file name in each module's build script, a build-specific mechanism that every dependency update had to repeat. Remove the VerifyDependencyDigests task, its registration in the shaded-JAR convention plugin and the digest maps of the agent and the correlator. The SHA-256 helpers the native bundle checks use move to NativeBundles.kt. Gradle's dependency locking remains available should resolved versions ever need to be locked.
lhotari
added
the
maintenance
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The shaded modules checked every embedded external library against a SHA-256 digest, pinned by file name in the agent's and the correlator's build scripts. That check was specific to this build, and every dependency update had to repeat the digests by hand. Dependabot's grouped updates would have needed the same manual step.
This PR removes it:
VerifyDependencyDigeststask and its registration injonoffcpu.shaded-jar-conventions, includingshadowJar's dependency on it.jonoffcpu-agent/build.gradle.ktsandjonoffcpu-correlator/build.gradle.kts, andextractJmcWriterSources's dependency on the check.sha256helpers, which the native bundle checksum checks still use, toNativeBundles.kt.Gradle's dependency locking remains available if resolved versions ever need to be locked.
These checks are unaffected:
SHA256SUMScheckdistributionSha256SumVerification
./gradlew :jonoffcpu-agent:check :jonoffcpu-correlator:checkpasses: 308 tests, 0 failures.--configuration-cache-problems=warnreports no problems, and the second run reuses the configuration cache.spotlessApplyis clean.