mirror of
https://github.com/apache/airflow.git
synced 2026-11-04 07:12:48 +00:00
Jason(Zhe-You) Liu
956b7f866a
The Java SDK build trusted whatever its configured repositories returned, so a replaced or shadowed artifact could execute during a build -- including in the buildSrc code that configures every published module -- without anything failing. Pinning checksums turns that substitution into a build error, and declaring repositories in one place gives reviewers a single spot to audit where bytes may come from. Checksums alone are trust-on-first-use: they prove an artifact has not changed since it was recorded, not that it was ever trustworthy. The README therefore documents the independent cross-check required when regenerating the metadata, and names the inputs this deliberately does not cover -- the auto-provisioned JDK toolchain and the downloaded Supervisor Schema -- so the guarantee is not read as broader than it is.
40 lines
1.2 KiB
Kotlin
40 lines
1.2 KiB
Kotlin
/*
|
|
* Licensed to the Apache Software Foundation (ASF) under one
|
|
* or more contributor license agreements. See the NOTICE file
|
|
* distributed with this work for additional information
|
|
* regarding copyright ownership. The ASF licenses this file
|
|
* to you under the Apache License, Version 2.0 (the
|
|
* "License"); you may not use this file except in compliance
|
|
* with the License. You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing,
|
|
* software distributed under the License is distributed on an
|
|
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
* KIND, either express or implied. See the License for the
|
|
* specific language governing permissions and limitations
|
|
* under the License.
|
|
*/
|
|
|
|
pluginManagement {
|
|
repositories {
|
|
gradlePluginPortal()
|
|
mavenCentral()
|
|
}
|
|
}
|
|
|
|
plugins {
|
|
id("org.gradle.toolchains.foojay-resolver-convention").version("0.10.0")
|
|
}
|
|
|
|
dependencyResolutionManagement {
|
|
repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
|
|
repositories {
|
|
mavenCentral()
|
|
}
|
|
}
|
|
|
|
rootProject.name = "airflow-java-sdk"
|
|
include("bom", "jpl", "jul", "log4j2", "plugin", "processor", "sdk", "slf4j")
|