josephearl / sbt-verify Goto Github PK

It appears gradle-witness may not be maintained anymore, would be nice to give it some love.

I tried to upgrade project using sbt-verify to sbt 1.3.0-RC2.

It looks that it has problems with handling dependencies managed by coursier - lists them as unverified, even in case when verifyGenerate is used (in this case list of paths to jar files is created).

Make project more usable - don't force users to build the jar themselves

As an alternative to or in addition to specifying the content hash.

signalapp/gradle-witness#18

Hi,

This is exactly what I was looking for. Except that it suffers from a bootstrapping problem as mentioned in the README.

Any chance you could help upstream this into sbt itself? I have raised an issue here:
sbt/sbt#5668

Perhaps you can chime in with more convincing arguments than me.

thanks,
hrj

From TODO comment in VerifyID

See signalapp/gradle-witness#17

The version is not required by the plugin to verify dependencies. However it can be useful/nice so you know what version of the dependency the hash relates to.