import org.apache.maven.artifact.Artifact;
import org.apache.maven.artifact.InvalidRepositoryException;
import org.apache.maven.artifact.factory.ArtifactFactory;
import org.apache.maven.artifact.metadata.ArtifactMetadataRetrievalException;
import org.apache.maven.artifact.metadata.ArtifactMetadataSource;
import org.apache.maven.artifact.metadata.ResolutionGroup;
import org.apache.maven.artifact.repository.ArtifactRepository;

  <groupId>com.google.guava</groupId>
  <artifactId>guava-bom</artifactId>
  <version>999.0.0-HEAD-android-SNAPSHOT</version>
  <packaging>pom</packaging>

  <name>Guava BOM</name>
  <description>BOM for Guava artifacts</description>
  <url>https://github.com/google/guava</url>
  <inceptionYear>2010</inceptionYear>

  <licenses>
    <license>
      <name>Apache License, Version 2.0</name>

import java.util.List;
import java.util.Set;

import org.apache.maven.artifact.Artifact;
import org.apache.maven.artifact.factory.ArtifactFactory;
import org.apache.maven.artifact.resolver.filter.AndArtifactFilter;
import org.apache.maven.artifact.resolver.filter.ArtifactFilter;
import org.apache.maven.artifact.resolver.filter.ExclusionArtifactFilter;
import org.apache.maven.artifact.versioning.InvalidVersionSpecificationException;

        List<String> elements = project.getCompileClasspathElements();
        assertEquals(2, elements.size());

        @SuppressWarnings("deprecation")
        List<Artifact> artifacts = project.getCompileArtifacts();
        assertEquals(1, artifacts.size());
        assertTrue(artifacts.get(0).getFile().getName().endsWith("tools.jar"));
    }

     * Collects the transitive dependencies of some artifacts and builds a dependency graph for the given path scope.
     * Note that this operation is only concerned about determining the coordinates of the transitive dependencies and
     * does not actually resolve the artifact files.
     *
     * @param session the {@link Session}, must not be {@code null}
     * @param artifact the {@link Artifact}, must not be {@code null}

 *
 * <p>Remote repositories are used for:
 * <ul>
 *   <li>Resolving artifacts and their metadata</li>
 *   <li>Downloading parent POMs and dependency POMs</li>
 *   <li>Retrieving version information and ranges</li>
 *   <li>Accessing plugin artifacts and their dependencies</li>
 * </ul>
 *
 * <p>Repository validation ensures data integrity by:
 * <ul>

        val nightlyBuildId = fetchNightlyBuildId(
            "https://androidx.dev/studio/builds"
        )
        val nightlyVersion = fetchNightlyVersion(
            "https://androidx.dev/studio/builds/$nightlyBuildId/artifacts/artifacts/repository/com/android/application/com.android.application.gradle.plugin/maven-metadata.xml"
        )
        val aapt2Versions = fetchAapt2Versions(
            latests.toSet().plus(nightlyVersion),

# Signing key for Gradle artifacts

Below is the public PGP key used to sign all Gradle artifacts.

The key ID is `E2F38302C8075E3D` and its fingerprint is `1BD97A6A154E7810EE0BC832E2F38302C8075E3D`.
You can also find the key in the [Gradle website](https://gradle.org/keys/) and on [public key servers](https://keys.openpgp.org/search?q=maven-publishing%40gradle.com).

## Verification instructions

### Importing the key

For debugging purposes we also need to keep track of what versions of artifacts are being used so that when we are debugging in the IDE we can find the specific sources for a given version of a library so that the developer can debug the correct version of a library being used for a plugin.

h3. Discovery all Plexus components

 *   <li><strong>Managed Dependencies Cleanup</strong>: Removes managed dependencies pointing to project artifacts</li>
 *   <li><strong>Dependency Inference</strong>:
 *     <ul>
 *       <li>Removes dependency {@code <version>} when it points to a project artifact</li>
 *       <li>Removes dependency {@code <groupId>} when it points to a project artifact</li>
 *       <li>Applies to main dependencies, profile dependencies, and plugin dependencies</li>