Is the Gradle witness plugin allowed?


#1

Hey,

I would like to integrate https://github.com/signalapp/gradle-witness in some apps. The plugin compairs hashsums of downloaded gradle depencies with a list in the gradle file. Because the plugin can be manipulated itself, it needs to be in the repo as jar file.
Are jar files allowed as depency in F-Droid?
Transportr also uses this plugin and I couldn’t see, that it’s removed for fdroid builds.


#2

Gradle Witness does not verify plugins and this makes its use quite questionable.

JARs are prohibited by the inclusion policy, but fdroidserver won’t throw an error if you add one.


#3

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.