gradle / gradle/plugin-portal-requests
Plugin portal should display checksums of plugin artifacts
- Dominant language
- No language data
- Stars
- 15
- Forks
- 6
- PR merge metrics
- No merged PRs in 30d
Description
Since publishing a plugin to the plugin portal does not require code signing, when enabling dependency verification, plugin artifacts often need to be verified using checksums. It would be great if the plugin portal had an easy way to review the checksums from a plugin’s page.
### Expected Behavior
When I navigate to the page of a plugin, there should be a list of all the plugin artifacts for this release together with their checksums.
### Current Behavior
There‘s no support for retrieving the checksums from the portal. Users need to know that https://plugins.gradle.org/m2 is the root of the maven repository and then need to navigate to the plugin manually.
### Context
I ran into this when I enabled dependency verification for one of the [GradleX plugins](https://github.com/gradlex-org/reproducible-builds).
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at a plugin’s page and trace how the release’s artifacts are exposed from the Maven repository rooted at plugins.gradle.org/m2. Determine how the page can present every artifact with its checksum; done means users can review those checksums directly from the plugin page.
Written by the indexing model from the issue text.
Assessment
- Domain
- web-dev
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100