}
                }
            }
        }

    }


    // Platforms cannot be published with plain Ivy
    @RequiredFeature(feature = GradleMetadataResolveRunner.REPOSITORY_TYPE, value = "maven")
    def "can align thanks to a published platform"() {
        repository {
            path 'databind:2.7.9 -> core:2.7.9'
            path 'databind:2.7.9 -> annotations:2.7.9'

                expectFiles "commons-collections-3.2.2.jar", "commons-io-1.4.jar", "publishTest-1.9.jar", "publishTest-1.9-source.jar"
            }
            withModuleMetadata {
                // additional files are not published in Gradle metadata
                expectFiles "commons-collections-3.2.2.jar", "commons-io-1.4.jar", "publishTest-1.9.jar"
            }
        }

        and:
        resolveArtifacts(javaLibrary) {

====

However:

- Gradle only supports verification of signatures published on remote repositories as ASCII-armored PGP files
- Not all artifacts are published with signatures
- A good signature doesn't mean that the signatory was legit

As a consequence, signature verification will often be used alongside checksum verification.

It depends on how they have been published and, specifically, whether they have been published with the necessary <<plugins#sec:plugin_markers,plugin marker artifacts>>.

For example, the Android Plugin for Gradle is not published to the Gradle Plugin Portal and — at least up to version 3.2.0 of the plugin — the metadata required to resolve the artifacts for a given plugin identifier is not published to the Google repository.

        def pkId = toHexString(keyring.publicKey.fingerprint)
        createMetadataFile {
            keyServer(keyServerFixture.uri)
            verifySignatures()
            // only the new keyring key is published and available
            addGloballyIgnoredKey(validPublicKeyLongIdHexString)
            addTrustedKey("org:foo:1.0", pkId)
            addTrustedKey("org:foo:1.0", pkId, "pom", "pom")
        }

    def "Attribute value on dependency only affects selection of this dependency (using published metadata)"() {
        given:
        repository {
            def modules = ['direct', 'transitive', 'leaf']
            modules.eachWithIndex { module, idx ->

By convention, test fixtures will be published with an artifact having the `test-fixtures` classifier.
For both Maven and Ivy, an artifact with that classifier is simply published alongside the regular artifacts.

     *   schema schemaJar
     * }
     * </pre>
     *
     * @param configureClosure the closure to use to configure the published artifacts.
     */
    void artifacts(@DelegatesTo(ArtifactHandler.class) Closure configureClosure);

    /**
     * <p>Configures the published artifacts for this project.
     *
     * <p>This method executes the given action against the {@link ArtifactHandler} for this project.

Testing on these versions will become an error in Gradle 9.0

[[kotlin_dsl_precompiled_gradle_lt_6]]
==== Applying Kotlin DSL precompiled scripts published with Gradle < 6.0

Applying Kotlin DSL precompiled scripts published with Gradle < 6.0 is deprecated.
Please use a version of the plugin published with Gradle >= 6.0.

[[kotlin_dsl_with_kgp_lt_1_8_0]]
==== Applying the `kotlin-dsl` together with Kotlin Gradle Plugin < 1.8.0

//
// This file is part of MinIO Object Storage stack
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful