gradle-witness icon indicating copy to clipboard operation
gradle-witness copied to clipboard

Witness incorrectly resolves dependency when older version is specified

Open duggulous opened this issue 6 years ago • 0 comments

Witness currently resolves the dependency file with the following code:

ResolvedArtifact dependency = project.configurations.compile.resolvedConfiguration.resolvedArtifacts.find{
     return it.name.equals(name) && it.moduleVersion.id.group.equals(group)
}

Because this only checks the group and name, and not version, this resolves the most recent version of that dependency in the cache. If you have more than one version in your cache and you are not using the newest one, you may be getting false negatives, because the plugin is not checking the file you are using.

This can also cause false positives if you calculate & record your checksum before adding a newer version of the dependency to your cache because Witness will compare the hash of the most recent version to the hash you recorded from the older version.

duggulous avatar Dec 04 '18 01:12 duggulous