Re: Dependency checksum verification vs PGP-based verification

[Vladimir Sitnikov]

>and follow the requirement from ASF:

I mean verification of dependencies at the build time.
I don't think ASF has a requirement to validate dependencies.

Vladimir