From 008cc5393a8b21e230489580f071def186b8d0de Mon Sep 17 00:00:00 2001 From: Michael Froh Date: Wed, 19 Aug 2026 12:12:15 -0700 Subject: [PATCH 1/7] Add Gradle-level verification of dependency SHAs This provides an extra level of defense against supply-chain attacks, as it verifies SHAs of buildSrc dependencies, by using a built-in feature provided by Gradle. Signed-off-by: Michael Froh --- DEVELOPER_GUIDE.md | 51 + gradle/verification-metadata.xml | 3721 ++++++++++++++++++++++++++++++ 2 files changed, 3772 insertions(+) create mode 100644 gradle/verification-metadata.xml diff --git a/DEVELOPER_GUIDE.md b/DEVELOPER_GUIDE.md index 93fb6470cfa15..e27ceb7e76155 100644 --- a/DEVELOPER_GUIDE.md +++ b/DEVELOPER_GUIDE.md @@ -385,6 +385,57 @@ For example, after adding `api "org.slf4j:slf4j-api:${versions.slf4j}"` to [plug Ensure that `./gradlew :plugins:discovery-ec2:check` passes before submitting changes. +### Dependency Verification + +Every artifact the build downloads, including the dependencies of the build itself (`buildSrc` / `build-tools`) and +the Gradle plugins applied by the build scripts, is checksum verified against +[gradle/verification-metadata.xml](gradle/verification-metadata.xml). Gradle performs this check before an artifact is +placed on any classpath, so a tampered dependency fails the build before its code can run. This protects the build +against a compromised upstream artifact, which is a gap that the per-project `licenses/*.jar.sha1` files do not cover +because they are only checked by the `dependencyLicenses` task, and only for shipped dependencies. + +Adding, removing or upgrading a dependency changes the set of artifacts that gets resolved, so the metadata has to be +regenerated. For a single dependency change, the quick way is to fetch the new artifact and then rewrite the metadata +from the local cache: + +``` +./gradlew -Dorg.gradle.dependency.verification=off +./gradlew --write-verification-metadata sha256 --offline +``` + +The first command populates the Gradle cache, since verification would otherwise reject the not-yet-recorded artifact. +The second records its checksum. Regeneration only ever adds entries, so a narrow task is enough: nothing that was +already recorded gets dropped. Passing `--offline` matters a great deal, because without it Gradle re-checks every +recorded component against the remote repositories, which takes minutes rather than seconds. If an artifact is not in +the cache yet, the offline run fails naming it rather than silently omitting it. + +To regenerate the file from scratch, drop it and resolve everything, which needs network access and takes several +minutes: + +``` +./gradlew --write-verification-metadata sha256 resolveAllDependencies precommit --continue +``` + +Both task names matter. `resolveAllDependencies` resolves every resolvable configuration, while `precommit` additionally +triggers the tools that resolve their own dependencies into detached configurations when they run, such as Spotless +pulling in `google-java-format`. Generating against only one of them produces metadata that is missing entries, and the +build then fails with `Dependency verification failed` naming the artifacts that were not recorded. Some +`resolveAllDependencies` tasks in `qa` and `distribution` fail unless the backwards compatibility distributions have +been built locally; `--continue` lets the rest of the run proceed, and those distributions are covered by a `` +rule rather than a checksum anyway. + +Because regeneration only adds entries, the file also never loses the record of a dependency that has been removed. +Deleting the file and regenerating it in full is the only way to prune those. + +Review the resulting diff before committing it. Regeneration records whatever is downloaded at that moment, so entries +should be added because a dependency genuinely changed, not because a checksum drifted underneath an unchanged +dependency. A changed checksum for a dependency whose version did not change is exactly the situation this check exists +to surface. + +OpenSearch's own distributions, which `DistributionDownloadPlugin` downloads for backwards compatibility and packaging +tests, are covered by a `` rule rather than by a checksum. Snapshot distributions are rebuilt continuously, so +there is no stable checksum to record. Third-party dependencies must never be added to that list. + ### Editor / IDE Support IntelliJ IDEs can [import](https://blog.jetbrains.com/idea/2014/01/intellij-idea-13-importing-code-formatter-settings-from-eclipse/) the [settings file](buildSrc/formatterConfig.xml), and / or use the [Eclipse Code Formatter](https://plugins.jetbrains.com/plugin/6546-eclipse-code-formatter) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml new file mode 100644 index 0000000000000..01daad2138709 --- /dev/null +++ b/gradle/verification-metadata.xml @@ -0,0 +1,3721 @@ + + + + false + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From f9638a8bcb7ff8f12412a1a4a2a9f6d7f9d1761a Mon Sep 17 00:00:00 2001 From: Michael Froh Date: Wed, 26 Aug 2026 14:51:40 -0700 Subject: [PATCH 2/7] Update to latest dependencies Signed-off-by: Michael Froh --- gradle/verification-metadata.xml | 329 ++++++++++++++++--------------- 1 file changed, 167 insertions(+), 162 deletions(-) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 01daad2138709..7ae530198793c 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -199,19 +199,19 @@ - - - + + + - - - + + + - - - + + + @@ -219,44 +219,44 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + @@ -1403,24 +1403,24 @@ - - - + + + - - - + + + - - - + + + - - - + + + @@ -3237,9 +3237,9 @@ - - - + + + @@ -3502,194 +3502,199 @@ - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + + + + + + From 680a462b979e95dfc8a8d9a9c35ed117312382e3 Mon Sep 17 00:00:00 2001 From: Michael Froh Date: Wed, 26 Aug 2026 15:01:54 -0700 Subject: [PATCH 3/7] Add artifacts needed for :server:japicmp target These artifacts will need to be updated on every release, but that is not a huge burden. Signed-off-by: Michael Froh --- gradle/verification-metadata.xml | 110 +++++++++++++++++++++++++++++-- 1 file changed, 105 insertions(+), 5 deletions(-) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 7ae530198793c..5f7ee65e62265 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -4,11 +4,6 @@ false false - @@ -199,6 +194,11 @@ + + + + + @@ -209,6 +209,11 @@ + + + + + @@ -224,6 +229,11 @@ + + + + + @@ -1403,6 +1413,11 @@ + + + + + @@ -3237,6 +3252,71 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -3697,21 +3777,41 @@ + + + + + + + + + + + + + + + + + + + + From b12e5bb9d2b3bfde604b11a8b232ed150fd8e4a7 Mon Sep 17 00:00:00 2001 From: Michael Froh Date: Wed, 26 Aug 2026 15:30:26 -0700 Subject: [PATCH 4/7] Add new Adoptium artifacts Signed-off-by: Michael Froh --- gradle/verification-metadata.xml | 60 ++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 5f7ee65e62265..d2d841ccbf0cd 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -26,6 +26,23 @@ + + + + + + + + + + + + + + + + + @@ -34,11 +51,24 @@ + + + + + + + + + + + + + @@ -56,6 +86,23 @@ + + + + + + + + + + + + + + + + + @@ -64,11 +111,24 @@ + + + + + + + + + + + + + From 3cb37effdb2f1c5970cbd1db92a874b7a03edcad Mon Sep 17 00:00:00 2001 From: Michael Froh Date: Wed, 26 Aug 2026 15:48:42 -0700 Subject: [PATCH 5/7] Add some more dependencies for :server:japicmp These are pulled in as part of :server:detachedConfiguration1, so they're not easy to ask Gradle to emit. I ended up just adding them by hand. Signed-off-by: Michael Froh --- gradle/verification-metadata.xml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index d2d841ccbf0cd..00113466067ee 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -914,6 +914,16 @@ + + + + + + + + + + @@ -1598,6 +1608,16 @@ + + + + + + + + + + @@ -2712,6 +2732,11 @@ + + + + + From 7c6d48484a1128e0e481bb4b155f5c3ba05a9557 Mon Sep 17 00:00:00 2001 From: Michael Froh Date: Thu, 27 Aug 2026 12:14:03 -0700 Subject: [PATCH 6/7] Add more :server:japicmp dependencies Signed-off-by: Michael Froh --- gradle/verification-metadata.xml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 00113466067ee..94bc851cbc7aa 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -504,6 +504,11 @@ + + + + + @@ -549,6 +554,11 @@ + + + + + @@ -624,6 +634,11 @@ + + + + + @@ -2652,6 +2667,11 @@ + + + + + From 02e0157370846eac101eb42b56b6f066f55d2fd3 Mon Sep 17 00:00:00 2001 From: Michael Froh Date: Thu, 27 Aug 2026 13:17:55 -0700 Subject: [PATCH 7/7] Add SHAs for sandbox sub-projects Signed-off-by: Michael Froh --- gradle/verification-metadata.xml | 342 +++++++++++++++++- .../licenses/jackson-core-2.22.1.jar.sha1 | 1 - .../licenses/jackson-core-2.22.2.jar.sha1 | 1 + .../licenses/jackson-databind-2.22.1.jar.sha1 | 1 - .../licenses/jackson-databind-2.22.2.jar.sha1 | 1 + .../jackson-datatype-jdk8-2.22.1.jar.sha1 | 1 - .../jackson-datatype-jdk8-2.22.2.jar.sha1 | 1 + .../jackson-dataformat-yaml-2.22.1.jar.sha1 | 1 - .../jackson-dataformat-yaml-2.22.2.jar.sha1 | 1 + 9 files changed, 338 insertions(+), 12 deletions(-) delete mode 100644 sandbox/libs/analytics-framework/licenses/jackson-core-2.22.1.jar.sha1 create mode 100644 sandbox/libs/analytics-framework/licenses/jackson-core-2.22.2.jar.sha1 delete mode 100644 sandbox/libs/analytics-framework/licenses/jackson-databind-2.22.1.jar.sha1 create mode 100644 sandbox/libs/analytics-framework/licenses/jackson-databind-2.22.2.jar.sha1 delete mode 100644 sandbox/plugins/analytics-backend-datafusion/licenses/jackson-datatype-jdk8-2.22.1.jar.sha1 create mode 100644 sandbox/plugins/analytics-backend-datafusion/licenses/jackson-datatype-jdk8-2.22.2.jar.sha1 delete mode 100644 sandbox/plugins/analytics-engine/licenses/jackson-dataformat-yaml-2.22.1.jar.sha1 create mode 100644 sandbox/plugins/analytics-engine/licenses/jackson-dataformat-yaml-2.22.2.jar.sha1 diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 94bc851cbc7aa..2c538a282fbf4 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -6,6 +6,7 @@ + @@ -154,6 +155,21 @@ + + + + + + + + + + + + + + + @@ -249,6 +265,11 @@ + + + + + @@ -264,6 +285,11 @@ + + + + + @@ -299,6 +325,11 @@ + + + + + @@ -389,6 +420,11 @@ + + + + + @@ -499,21 +535,31 @@ + + + + + - - - - - + + + + + + + + + + @@ -524,6 +570,11 @@ + + + + + @@ -549,6 +600,11 @@ + + + + + @@ -579,6 +635,11 @@ + + + + + @@ -669,6 +730,11 @@ + + + + + @@ -704,6 +770,11 @@ + + + + + @@ -714,6 +785,11 @@ + + + + + @@ -744,6 +820,16 @@ + + + + + + + + + + @@ -954,6 +1040,16 @@ + + + + + + + + + + @@ -1084,6 +1180,16 @@ + + + + + + + + + + @@ -1523,6 +1629,26 @@ + + + + + + + + + + + + + + + + + + + + @@ -1588,6 +1714,11 @@ + + + + + @@ -1728,6 +1859,11 @@ + + + + + @@ -1758,11 +1894,21 @@ + + + + + + + + + + @@ -1788,11 +1934,21 @@ + + + + + + + + + + @@ -1803,6 +1959,16 @@ + + + + + + + + + + @@ -1823,6 +1989,11 @@ + + + + + @@ -1838,6 +2009,41 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1868,6 +2074,11 @@ + + + + + @@ -1893,6 +2104,21 @@ + + + + + + + + + + + + + + + @@ -2667,9 +2893,9 @@ - - - + + + @@ -2682,6 +2908,11 @@ + + + + + @@ -2692,6 +2923,31 @@ + + + + + + + + + + + + + + + + + + + + + + + + + @@ -3107,6 +3363,11 @@ + + + + + @@ -3127,6 +3388,11 @@ + + + + + @@ -3207,6 +3473,11 @@ + + + + + @@ -3242,6 +3513,11 @@ + + + + + @@ -3257,6 +3533,11 @@ + + + + + @@ -3267,6 +3548,11 @@ + + + + + @@ -3287,6 +3573,11 @@ + + + + + @@ -3327,11 +3618,31 @@ + + + + + + + + + + + + + + + + + + + + @@ -3552,6 +3863,11 @@ + + + + + @@ -3682,6 +3998,16 @@ + + + + + + + + + + diff --git a/sandbox/libs/analytics-framework/licenses/jackson-core-2.22.1.jar.sha1 b/sandbox/libs/analytics-framework/licenses/jackson-core-2.22.1.jar.sha1 deleted file mode 100644 index e2c41405d169c..0000000000000 --- a/sandbox/libs/analytics-framework/licenses/jackson-core-2.22.1.jar.sha1 +++ /dev/null @@ -1 +0,0 @@ -da7ffb60088d7e8f37ecdd3b617520971cc7b9bf \ No newline at end of file diff --git a/sandbox/libs/analytics-framework/licenses/jackson-core-2.22.2.jar.sha1 b/sandbox/libs/analytics-framework/licenses/jackson-core-2.22.2.jar.sha1 new file mode 100644 index 0000000000000..67dfe67ab4b45 --- /dev/null +++ b/sandbox/libs/analytics-framework/licenses/jackson-core-2.22.2.jar.sha1 @@ -0,0 +1 @@ +13a748ea3e329fa220076e021b45c8391b32420c \ No newline at end of file diff --git a/sandbox/libs/analytics-framework/licenses/jackson-databind-2.22.1.jar.sha1 b/sandbox/libs/analytics-framework/licenses/jackson-databind-2.22.1.jar.sha1 deleted file mode 100644 index 7b38d1b99d9d0..0000000000000 --- a/sandbox/libs/analytics-framework/licenses/jackson-databind-2.22.1.jar.sha1 +++ /dev/null @@ -1 +0,0 @@ -9e2fb91831cce9cb9262909cd76647508949f232 \ No newline at end of file diff --git a/sandbox/libs/analytics-framework/licenses/jackson-databind-2.22.2.jar.sha1 b/sandbox/libs/analytics-framework/licenses/jackson-databind-2.22.2.jar.sha1 new file mode 100644 index 0000000000000..de250cf9085be --- /dev/null +++ b/sandbox/libs/analytics-framework/licenses/jackson-databind-2.22.2.jar.sha1 @@ -0,0 +1 @@ +921bd2092b0c539b2876de7063d55c72edcd05d3 \ No newline at end of file diff --git a/sandbox/plugins/analytics-backend-datafusion/licenses/jackson-datatype-jdk8-2.22.1.jar.sha1 b/sandbox/plugins/analytics-backend-datafusion/licenses/jackson-datatype-jdk8-2.22.1.jar.sha1 deleted file mode 100644 index 8aec5b1d3886e..0000000000000 --- a/sandbox/plugins/analytics-backend-datafusion/licenses/jackson-datatype-jdk8-2.22.1.jar.sha1 +++ /dev/null @@ -1 +0,0 @@ -ef21a94e7b5603f57ca1efe9215513d210d96320 \ No newline at end of file diff --git a/sandbox/plugins/analytics-backend-datafusion/licenses/jackson-datatype-jdk8-2.22.2.jar.sha1 b/sandbox/plugins/analytics-backend-datafusion/licenses/jackson-datatype-jdk8-2.22.2.jar.sha1 new file mode 100644 index 0000000000000..ef40d77269bbb --- /dev/null +++ b/sandbox/plugins/analytics-backend-datafusion/licenses/jackson-datatype-jdk8-2.22.2.jar.sha1 @@ -0,0 +1 @@ +0b900dd7125fa16cfdf46135d3ffb3243d0f8b88 \ No newline at end of file diff --git a/sandbox/plugins/analytics-engine/licenses/jackson-dataformat-yaml-2.22.1.jar.sha1 b/sandbox/plugins/analytics-engine/licenses/jackson-dataformat-yaml-2.22.1.jar.sha1 deleted file mode 100644 index 597173dcd7fc3..0000000000000 --- a/sandbox/plugins/analytics-engine/licenses/jackson-dataformat-yaml-2.22.1.jar.sha1 +++ /dev/null @@ -1 +0,0 @@ -af5fde2414e4a8d2617e7890f7068c26b5b66a33 \ No newline at end of file diff --git a/sandbox/plugins/analytics-engine/licenses/jackson-dataformat-yaml-2.22.2.jar.sha1 b/sandbox/plugins/analytics-engine/licenses/jackson-dataformat-yaml-2.22.2.jar.sha1 new file mode 100644 index 0000000000000..78dcb210d0996 --- /dev/null +++ b/sandbox/plugins/analytics-engine/licenses/jackson-dataformat-yaml-2.22.2.jar.sha1 @@ -0,0 +1 @@ +a4f075bf4cc1ee814ab98d69c1612786c2f42bc3 \ No newline at end of file