2024522 - Generate dependency verification metadata for gradle deps

Status: RESOLVED FIXED

(Firefox for Android :: Tooling, task)

Description

[Jonathan Almeida [:jonalmeida]]

We want some external dependencies to be validated that the artifacts do not change without us being notified. This is a helpful security feature built into gradle that we can employ.

Comment 1

[Jonathan Almeida [:jonalmeida]]

Attachment: Bug 2024522 - Generate dependency verification metadata for mockito. r=RyanVM,mcarare

Used: ./gradlew --write-verification-metadata sha256 help
Limited to only mockito with wildcards.

Source: https://docs.gradle.org/current/userguide/dependency_verification.html

Comment 2

[Jonathan Almeida [:jonalmeida]]

Attachment: Bug 2024522 - Add write-verification-metadata subcommand r=ahochheiden

To make it easier to update the verification-metadata.xml file with
mach gradle writeVerificationMetadata will cover our supported
projects.

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/0a031f79d566
https://hg.mozilla.org/integration/autoland/rev/4f1070832717
Generate dependency verification metadata for mockito. r=mcarare,android-reviewers
https://github.com/mozilla-firefox/firefox/commit/7b74d86ca4ce
https://hg.mozilla.org/integration/autoland/rev/0fa3dfdbb00c
Add write-verification-metadata subcommand r=ahochheiden

Comment 4

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/4f1070832717
https://hg.mozilla.org/mozilla-central/rev/0fa3dfdbb00c