settings: drop foojay toolchain resolver (reproducible-build safe)
Calendula consumes the kit as an included build and publishes via official F-Droid reproducible builds, whose offline source scanner rejects the foojay toolchain resolver (it can fetch a JDK at build time). The kit never used a Java toolchain block — modules set jvmTarget directly — so the resolver was dead weight that would have broken Calendula's reproducibility invariant. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -11,9 +11,12 @@ pluginManagement {
|
||||
gradlePluginPortal()
|
||||
}
|
||||
}
|
||||
plugins {
|
||||
id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0"
|
||||
}
|
||||
|
||||
// NB: deliberately NO foojay toolchain resolver. Consuming apps build this as an
|
||||
// included build, and Calendula publishes via official F-Droid reproducible
|
||||
// builds, whose offline source scanner rejects org.gradle.toolchains.foojay-resolver
|
||||
// (it can fetch a JDK at build time). Modules here set jvmTarget directly and
|
||||
// must not use a Java toolchain block that would need a resolver.
|
||||
|
||||
dependencyResolutionManagement {
|
||||
repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
|
||||
|
||||
Reference in New Issue
Block a user