paulk-asert opened a new pull request, #2802: URL: https://github.com/apache/groovy/pull/2802
The Maven-backed Grape engine resolved with CHECKSUM_POLICY_WARN, so an artifact whose published checksum did not match was logged and then added to the class loader and had its META-INF services processed. The Ivy-backed engine fails resolution in that situation, so the Maven engine silently dropped an integrity check that Grape already had. Resolve with CHECKSUM_POLICY_FAIL instead. Maven Resolver's stock fail policy also rejects artifacts that publish no checksum at all, which the Ivy engine accepts and which is common for internal and older repositories, so install a checksum policy provider that wraps the fail policy and relaxes only its onNoMoreChecksums() response. Both engines then behave alike and no artifact resolvable today stops resolving. The disableChecksums opt-out is unchanged: @GrabConfig(disableChecksums=true), -Dgroovy.grape.disableChecksums and Grape.setDisableChecksums(boolean) all still map to CHECKSUM_POLICY_IGNORE. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
