Skip to content

Add AutoStyle key to dependency verification keyring#6740

Open
sakshichitnis27 wants to merge 1 commit into
apache:masterfrom
sakshichitnis27:codex/jmeter-6713-dependency-verification
Open

Add AutoStyle key to dependency verification keyring#6740
sakshichitnis27 wants to merge 1 commit into
apache:masterfrom
sakshichitnis27:codex/jmeter-6713-dependency-verification

Conversation

@sakshichitnis27

Copy link
Copy Markdown

Summary

  • Add the AutoStyle 4.0.1 release key to Gradle's checked-in dependency verification keyring.
  • Keep signature verification enabled while allowing builds to verify AutoStyle artifacts without reaching an external key server.

Background

JMeter's verification metadata already trusts AutoStyle fingerprint
6FF955169D698CC09BA7403AC99BFE8CD562EAC1, but the corresponding public key
was not present in gradle/verification-keyring.keys.

When the configured public key servers are unavailable, Gradle cannot verify the
AutoStyle 4.0.1 metadata used by the build logic. This stops the build during
:build-logic:build-parameters:compileJava before JMeter itself can be compiled.

This change adds only that public key to the local keyring. It does not disable
dependency verification, ignore the signing key, change a dependency version, or
add a checksum exception.

Verification

  • Reproduced the failure with external key servers disabled: the same five
    AutoStyle 4.0.1 artifacts failed verification.
  • Verified all eight downloaded AutoStyle 4.0.1 signatures independently against
    fingerprint 6FF955169D698CC09BA7403AC99BFE8CD562EAC1.
  • Repeated the restricted-key-server build after adding the key; the build
    configuration completed successfully.
  • Ran ./gradlew --quiet check -PjdkTestVersion=21.
  • Ran ./gradlew --quiet :src:dist:assemble -PjdkTestVersion=21.
  • Verified the generated binary ZIP with unzip -t.

Refs #6713

@sakshichitnis27
sakshichitnis27 marked this pull request as ready for review July 27, 2026 02:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant