Repository navigation
Pin checksums of IDE source jars - #175
Merged
Merged
Conversation
Android Studio sync downloads *-sources.jar and gradle-*-src.zip for code navigation, through a detached configuration. None are listed in verification-metadata.xml, so every sync failed with 113 verification errors and the IDE could not load the project. Trust only those two file patterns. Sources never reach a build classpath; binary jars and POMs stay fully verified. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This reverts commit a584151.
Android Studio sync downloads *-sources.jar for every plugin and library on the build classpath, plus gradle-9.8.1-src.zip, through a detached configuration. None had a checksum, so each sync failed with 113+ verification errors. Add sha256 entries for the source jars, generated by resolving each module's SourcesArtifact with --write-verification-metadata. Only additions; no existing entry changed. The Gradle src.zip uses the checksum Gradle publishes on services.gradle.org. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
SamiPr0
changed the title
|
This was referenced Oct 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Android Studio sync downloads
*-sources.jarfor every plugin and library on the build classpath, plusgradle-9.8.1-src.zip, through a detached configuration (:app:detachedConfiguration2). None had a checksum ingradle/verification-metadata.xml, so every sync failed with 113+ verification errors and the IDE could not load the project.Change
Source jars stay verified.
gradle/verification-metadata.xmlgains sha256 entries for them (additions only, no existing entry changed):--write-verification-metadata sha256while resolving every module'sSourcesArtifact(buildscript classpath: 114 sources,:app: 454).gradle-9.8.1-src.zipuses the checksum Gradle publishes atservices.gradle.org/distributions/gradle-9.8.1-src.zip.sha256. I did not download the zip to compare, so a wrong value fails verification when the IDE fetches it.Verification
main.🤖 Generated with Claude Code