On Thu, Apr 16, 2015 at 9:24 AM, Cédric Champeau <[email protected]> wrote: > ...if we cannot keep it in the source zip (which would be > very unfortunate) I would rather vote on keeping it in Git, and when we do > a release not include it and instead generate a README that tells you > *which* version of Gradle to install to be able to reproduce the build...
These instructions will point to the URL of the required binary and maybe include an sha1 that makes sure you got the right one. So why can't you script that download? And maybe cache it locally like in my Sling example, for convenience. >From the ASF's best practices point of view you'd just need to inform the user about what you are downloading, and give them the opportunity to refuse to do that, if they don't agree with the license of that dependency. -Bertrand
