gradle / gradle/plugin-portal-requests

Plugin portal should display checksums of plugin artifacts

Open
#254 0 comments 4 reactions 0 assignees View on GitHub
a:feature portal
Dominant language
No language data
Stars
15
Forks
6
PR merge metrics
No merged PRs in 30d

Description

Since publishing a plugin to the plugin portal does not require code signing, when enabling dependency verification, plugin artifacts often need to be verified using checksums. It would be great if the plugin portal had an easy way to review the checksums from a plugin’s page.

### Expected Behavior

When I navigate to the page of a plugin, there should be a list of all the plugin artifacts for this release together with their checksums.

### Current Behavior

There‘s no support for retrieving the checksums from the portal. Users need to know that https://plugins.gradle.org/m2 is the root of the maven repository and then need to navigate to the plugin manually.

### Context

I ran into this when I enabled dependency verification for one of the [GradleX plugins](https://github.com/gradlex-org/reproducible-builds).

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at a plugin’s page and trace how the release’s artifacts are exposed from the Maven repository rooted at plugins.gradle.org/m2. Determine how the page can present every artifact with its checksum; done means users can review those checksums directly from the plugin page.

Written by the indexing model from the issue text.

Assessment

Domain
web-dev
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.