////
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied.  See the License for the
specific language governing permissions and limitations
under the License.
////

= Gradle Dependency Verification
The Apache OFBiz Project
Release trunk

CAUTION: This feature is for now disabled. You may use it locally if you want...



https://docs.gradle.org/current/userguide/dependency_verification.html[Here is the Gradle documentation about dependency verification]

As it's a long read you might prefer this summary:

NOTE: the dependency verification is an incubating feature. So we will wait before backporting from trunk...

By default OFBiz comes with OOTB Gradle dependency verification.

This means that it embeds a verification-metadata.xml file and a verification-keyring.gpg in OFBiz gradle sub-directory which is used during builds and other tasks to verify dependencies.

These files are initially created using :

TIP: gradlew --write-verification-metadata pgp,sha256 help +
gradlew --write-verification-metadata pgp,sha256 --export-keys

These command creates or updates the verification-metadata.xml and verification-keyring.gpg files which respectively contains the checksums for each of declared dependencies and the related keys
  

Currently the status is it's incomplete in OFBiz. You get this message:

* Some artifacts aren't signed or the signature couldn't be retrieved.
* Some signature verification failed. Checksums were generated for those artifacts but you MUST check if there's an actual problem. Look for entries with the following comment: PGP verification failed
PGP verification failed

Only 6 keys are concerned. This does not prevent the verification to work using metadata, though it's better to check the situation in case of doubts (OK OTTB). You may use

TIP: gradlew build --refresh-keys

To recreate the keys

The verification-metadata.xml file contains 2 entries that can be set to true or false to check or ignore the 2 functionalities:

IMPORTANT: <verify-metadata>true</verify-metadata> +
<verify-signatures>true</verify-signatures>


Finally, you may refer to https://issues.apache.org/jira/browse/OFBIZ-12186 for more information.
