settings: drop foojay toolchain resolver (reproducible-build safe)
Calendula consumes the kit as an included build and publishes via official F-Droid reproducible builds, whose offline source scanner rejects the foojay toolchain resolver (it can fetch a JDK at build time). The kit never used a Java toolchain block — modules set jvmTarget directly — so the resolver was dead weight that would have broken Calendula's reproducibility invariant. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -11,9 +11,12 @@ pluginManagement {
|
|||||||
gradlePluginPortal()
|
gradlePluginPortal()
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
plugins {
|
|
||||||
id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0"
|
// NB: deliberately NO foojay toolchain resolver. Consuming apps build this as an
|
||||||
}
|
// included build, and Calendula publishes via official F-Droid reproducible
|
||||||
|
// builds, whose offline source scanner rejects org.gradle.toolchains.foojay-resolver
|
||||||
|
// (it can fetch a JDK at build time). Modules here set jvmTarget directly and
|
||||||
|
// must not use a Java toolchain block that would need a resolver.
|
||||||
|
|
||||||
dependencyResolutionManagement {
|
dependencyResolutionManagement {
|
||||||
repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
|
repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
|
||||||
|
|||||||
Reference in New Issue
Block a user