mirror of
https://github.com/runelite/plugin-hub.git
synced 2025-12-23 22:48:49 -05:00
@@ -117,7 +117,7 @@ Instead, prefer using https://docs.oracle.com/javase/8/docs/api/java/lang/Class.
|
||||
|
||||
## Third party dependencies
|
||||
We require any dependencies that are not a transitive dependency of runelite-client to
|
||||
be have their cryptographic hash verified during the build to prevent [supply chain attacks](https://en.wikipedia.org/wiki/Supply_chain_attack) and ensure build reproducability.
|
||||
have their cryptographic hash verified during the build to prevent [supply chain attacks](https://en.wikipedia.org/wiki/Supply_chain_attack) and ensure build reproducability.
|
||||
To do this we rely on [Gradle's dependency verification](https://docs.gradle.org/nightly/userguide/dependency_verification.html).
|
||||
To add a new dependency, add it to the `thirdParty` configuration in [`package/verification-template/build.gradle`](https://github.com/runelite/plugin-hub/blob/master/package/verification-template/build.gradle),
|
||||
then run `../gradlew --write-verification-metadata sha256` to update the metadata file. A maintainer must then verify
|
||||
|
||||
Reference in New Issue
Block a user