sebb>Where does it get the SHA1 values? >From Maven Central. Sonatype repository requires all artifacts to have SHA1 and PGP.
sebb>Does the build process always download all the files? Gradle has resolution cache, so it does not download dependencies on each build. It uses its own folder structure that uses different files even for the case when different repositories have different content for the very same artifact version. sebb>Surely it checks whether there is already a local copy? We rely on Gradle to resolve dependencies, and it does that just fine. It does not suffer from "different artifacts have the same filename" issue. Local file location is like $HOME/.gradle/caches/modules-2/files-2.1/com.squareup.okio/okio/2.2.2/36f483536153f15339a8b48d508e22be7c9c531a/okio-2.2.2.jar 36f483536153f15339a8b48d508e22be7c9c531a is SHA1 of the file contents. sebb>Maven does do so, but there have been JMeter dependencies not in Maven where that was not necessarily true To my best knowledge the current build script never uses file names to cache information. We always use artifact ids, and we rely on Gradle's dependency cache, so the issue you mention is indeed impossible. Vladimir
