Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a system property to disable publishing of SHA-256 #11358

Merged
merged 1 commit into from Nov 14, 2019

Conversation

melix
Copy link
Contributor

@melix melix commented Nov 13, 2019

This commit adds an internal system property which can be used as
a workaround whenever the remote repository doesn't accept SHA-256
and SHA-512 checksums. Gradle is fail-safe when it cannot upload
those files, however, in some situations, the remote repository may
not allow promoting the release if it finds such files. This is the
case in older repositories, or currently with Maven Central.

To disable publication of both SHA-256 and SHA-512 checksums, either:

  • add -Dorg.gradle.internal.publish.checksums.insecure to the CLI or
  • add org.gradle.internal.publish.checksums.insecure=true to your
    gradle.properties file

Fixes #11308

@melix melix added the in:dependency-management DO NOT USE label Nov 13, 2019
@melix melix added this to the 6.0.1 milestone Nov 13, 2019
@melix melix self-assigned this Nov 13, 2019
This commit adds an internal system property which can be used as
a workaround whenever the remote repository doesn't accept SHA-256
and SHA-512 checksums. Gradle is fail-safe when it cannot upload
those files, however, in some situations, the remote repository may
not allow promoting the release if it finds such files. This is the
case in older repositories, or currently with Maven Central.

To disable publication of both SHA-256 and SHA-512 checksums, either:

- add `-Dorg.gradle.internal.publish.checksums.insecure` to the CLI or
- add `org.gradle.internal.publish.checksums.insecure=true` to your
`gradle.properties` file

Fixes #11308
@vlsi
Copy link
Contributor

vlsi commented Nov 13, 2019

Does this prevent maven-metadata.xml.sha512 as well?

@melix
Copy link
Contributor Author

melix commented Nov 13, 2019

yes

Copy link
Contributor

@jjohannes jjohannes left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@melix
Copy link
Contributor Author

melix commented Nov 14, 2019

If the workaround stays for too long, we should probably replace this with an API on repository declaration to express supported checksums.

@melix melix merged commit 295f13b into release Nov 14, 2019
@melix melix deleted the cc/dm/disable-sha256 branch November 14, 2019 12:51
operasfantom pushed a commit to JetBrains/rd that referenced this pull request Dec 16, 2019
korifey pushed a commit to JetBrains/rd that referenced this pull request Dec 16, 2019
@autonomousapps
Copy link
Contributor

I added org.gradle.internal.publish.checksums.insecure=true to my gradle.properties, but publishing still included the unwanted checksums. Could it be because all of the publishing concerns are configured in a precompiled script plugin, which is applied to the root build script? My project is at https://github.com/autonomousapps/dependency-analysis-android-gradle-plugin

@RaduFurnea
Copy link

@autonomousapps seems like there was a clarification made in another issue.
#11308 (comment)

@autonomousapps
Copy link
Contributor

Maven Central actually fixed the root problem, so this isn't needed anymore.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants