Gradle plugin jar in plugins.gradle.org file differs from maven central artifact

[gschueler]

I'm unsure if this is an issue with gradle plugin repository, or perhaps the axion-release-plugin release artifact itself.

I'm using Gradle Dependency Verification in my project, which verifies SHAs as well as PGP signatures of dependencies, including gradle plugins.

The axion-release gradle plugin fails the signature verification when checked by Gradle, which results in requiring using the SHA checksum in the verification metadata file. The plugins.gradle.org repo doesn't seem to host any .asc signatures, only the jar and pom artifacts, and so for other Gradle plugins it seems you must still use SHA due to missing signature.

However, for axion-release-plugin, the .jar artifact is actually different (SHA checksum differs) from the maven central artifact, so it seems to cause the signature check to report "Bad signature".

Is this expected?

---

more detail:

I verified that the maven central .jar and .asc signature is valid. (from here). "gpg: Good signature from "Allegro Group (Allegro Group Maven Key) [email protected]" [unknown]".

However, the .jar artifact from plugins.gradle.org, while having the exact same file size, must have some binary difference from the maven central artifact. The same .asc signature file fails to verify. "gpg: BAD signature from "Allegro Group (Allegro Group Maven Key) [email protected]" [unknown]". SHAs differ between the two files.

d2c1fc3da5acd2e7e5409e1e4b5cc16736173c0749fd3f45cea91594f693d5c3  axion-release-plugin-1.13.7.jar.orig #from maven central
144b01e5daceae7570d774258e2d56c633f2dbec2b0d4713a163684141adcb4d  axion-release-plugin-1.13.7.jar

[bgalek]

Hi @gschueler, no this is certainly not expected!
I'll dig into this today and make sure that next version will be the same! (I'll create 1.13.8 for this)

[bgalek]

@gschueler can you check now, 1.13.9? I think I found the issue and fixed it ;)

[gschueler]

@bgalek thanks, the .jar file signature now works!

The .pom file still appears different between plugins.gradle.org and maven central, however it seems like that is also the case for other gradle plugins as well.

[bgalek]

That's good news! Thx for your support!