add debug step to determine cause of failing verification
What the developer wrote
Authored by Craig Raw
add debug step to determine cause of failing verification
What changed, and why it matters
This commit adds temporary debug logging to a GitHub Actions build workflow. It prints file hashes and downloads a public Maven module to help diagnose why Gradle dependency verification is failing. There is no code change to the Sparrow Wallet application itself and no security-relevant behavior.
No security action required. Treat as routine CI debugging. Ensure the step is removed once the verification failure is resolved so it does not become permanent noise.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch inserts a single ‘Debug opentelemetry-bom bytes seen by this runner’ step into .github/workflows/package.yaml before the Gradle build. It searches for cached copies of opentelemetry-bom-1.55.0.module, downloads the same file from Maven Central, shows the pinned checksum in gradle/verification-metadata.xml, and lists Gradle init scripts. This is diagnostic instrumentation for a CI verification failure, not a product change.
Changed components
.github/workflows/package.yamlInspect captured patch +13 / −0
diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
index 43c72e3..82ee14c 100644
--- a/.github/workflows/package.yaml
+++ b/.github/workflows/package.yaml
@@ -25,6 +25,19 @@ jobs:
java-version: '25.0.2'
- name: Show Build Versions
run: ./gradlew -v
+ - name: Debug opentelemetry-bom bytes seen by this runner
+ shell: bash
+ run: |
+ echo "=== Any cached copy on the runner (before build downloads anything): ==="
+ find ~ /opt -name 'opentelemetry-bom-1.55.0.module' 2>/dev/null | while read f; do
+ echo "$f size=$(wc -c < "$f") sha512=$(shasum -a 512 "$f" | cut -d' ' -f1)"
+ done
+ echo "=== Fresh download from Maven Central (from this runner): ==="
+ curl -sL https://repo1.maven.org/maven2/io/opentelemetry/opentelemetry-bom/1.55.0/opentelemetry-bom-1.55.0.module | shasum -a 512
+ echo "=== Pinned in verification-metadata.xml: ==="
+ grep -A2 'opentelemetry-bom-1.55.0.module' gradle/verification-metadata.xml | head -3
+ echo "=== Gradle init scripts present: ==="
+ find ~ /opt -path '*gradle*init.d*' -type f 2>/dev/null | head -20
- name: Build with Gradle
run: ./gradlew jpackage
- name: Codesign, package and notarize macOS distribution
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.