We have to build artifacts from source code, including the dependencies. I am trying to build from tag 2.5.14. For example, spring-boot dependencies (a bunch of spring-* 5.3.20 jars) are built from source code and included in my local maven cache. Still, using the gradle wrapper of the project, it refuses to use the artifacts from the maven cache, most probably because the checksum is not the same as the project would expect (the same source code built on different environments results in different artifacts). I have tried it with using the option --dependency-verification set to off and it still downloads the jar from mavenCentral. The pom file is loaded from the maven cache because the checksum is the same.
At this point, I find it impossible to adhere to our local policies because the project accepts only the dependencies that are on mavenCentral (or identical artifacts to those).
Comment From: snicoll
Our build uses Gradle and does not use the local Maven cache at all. I am afraid this isn't the right place to discuss how to use/configure Gradle to achieve your goal.
Comment From: aboncok
@snicoll FYI it does use local maven cache, as this is how Gradle works. Example from the spring-boot 2.5.14 build log:
Found locally available resource with matching checksum: [https://repo.maven.apache.org/maven2/org/mockito/mockito-core/3.9.0/mockito-core-3.9.0.jar, ...\.m2\repository\org\mockito\mockito-core\3.9.0\mockito-core-3.9.0.jar]
So, I guess this is a no fix issue, project ignoring the --dependency-verification option.
Comment From: wilkinsona
FYI it does use local maven cache, as this is how Gradle works
Just for the record, this isn't the case for Spring Boot's build, or for many other Gradle projects. Using Maven local in a Gradle build is discouraged and Gradle will only use the local Maven cache as a repository if it has been explicitly configured to do so. In line with this, the 2.5.4 tag should only use mavenCentral().