Skip to content

Add KSP 2.3.11 verification metadata - #368

Closed
skrcode wants to merge 1 commit into
GrapheneOS:dependabot/gradle/main/com.google.devtools.ksp-symbol-processing-gradle-plugin-2.3.11from
skrcode:jaipilot/ksp-2.3.11-verification
Closed

Add KSP 2.3.11 verification metadata#368
skrcode wants to merge 1 commit into
GrapheneOS:dependabot/gradle/main/com.google.devtools.ksp-symbol-processing-gradle-plugin-2.3.11from
skrcode:jaipilot/ksp-2.3.11-verification

Conversation

@skrcode

@skrcode skrcode commented Aug 28, 2026

Copy link
Copy Markdown

Companion fix for #360.

The KSP 2.3.11 update is blocked by strict Gradle dependency verification because the new plugin artifacts are not yet trusted. This adds the generated SHA-512 entries for exactly the six KSP 2.3.11 JAR/module artifacts resolved by the build:

  • symbol-processing-api
  • symbol-processing-common-deps
  • symbol-processing-gradle-plugin

Each checksum was independently verified against the downloaded artifact. No existing trust entries were removed or weakened.

Verification:

  • ./gradlew build
  • BUILD SUCCESSFUL in 9m 43s
  • 146 tasks completed
  • xmllint --noout gradle/verification-metadata.xml
  • git diff --check

@thestinger thestinger closed this Aug 28, 2026
@thestinger

Copy link
Copy Markdown
Member

ll be handled as part of updating it with the standard way we generate verification metadata. We're updating most dependencies prior to releases rather than continuously doing it since there are so many updates and it would take too much time.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants