@@ -13,29 +13,29 @@ A small library of (hopefully) useful Java classes.
1313
1414## Java version
1515
16- Since version 2.0.0 of this library, it requires Java 11 or higher. If you
17- need a version compatible with Java 8, please use version 1.0.3.
16+ Since version 2 of this library, it requires Java 11 or higher. If you
17+ need a version compatible with Java 8, please use the last version 1
18+ release (1.0.3).
1819
1920## Maven Coordinates
2021
2122Below are instructions on how to add this library to your project
22- using various build tools. Just replace the version ` x.y.z ` with the
23- desired version (see Maven Central badge above for the latest).
23+ using various build tools.
2424
2525### Apache Maven
2626
2727``` xml
2828<dependency >
2929 <groupId >org.leplus</groupId >
3030 <artifactId >ristretto</artifactId >
31- <version >x.y.z </version >
31+ <version >2.0.0 </version >
3232</dependency >
3333```
3434
3535### Apache Ivy
3636
3737``` xml
38- <dependency org =" org.leplus" name =" ristretto" rev =" x.y.z " >
38+ <dependency org =" org.leplus" name =" ristretto" rev =" 2.0.0 " >
3939 <artifact name =" ristretto" type =" jar" />
4040</dependency >
4141```
@@ -44,7 +44,7 @@ desired version (see Maven Central badge above for the latest).
4444
4545``` groovy
4646@Grapes(
47- @Grab(group='org.leplus', module='ristretto', version='x.y.z ')
47+ @Grab(group='org.leplus', module='ristretto', version='2.0.0 ')
4848)
4949```
5050
@@ -54,28 +54,28 @@ If you use ristretto in your implementation only:
5454
5555``` gradle
5656dependencies {
57- implementation 'org.leplus:ristretto:x.y.z '
57+ implementation 'org.leplus:ristretto:2.0.0 '
5858}
5959```
6060
6161If you expose ristretto types in your public API:
6262
6363``` gradle
6464dependencies {
65- api("org.leplus:ristretto:x.y.z ")
65+ api("org.leplus:ristretto:2.0.0 ")
6666}
6767```
6868
6969### Scala SBT
7070
7171``` scala
72- libraryDependencies += " org.leplus" % " ristretto" % " x.y.z "
72+ libraryDependencies += " org.leplus" % " ristretto" % " 2.0.0 "
7373```
7474
7575### Leiningen
7676
7777``` clojure
78- [org.leplus/ristretto " x.y.z " ]
78+ [org.leplus/ristretto " 2.0.0 " ]
7979```
8080
8181## Usage
@@ -166,13 +166,12 @@ on Maven Central or whever you got the jar from.
166166To verify the jar using its sigstore signature, you need to download
167167them both locally and then use the ` cosign ` tool to verify the
168168signature. The whole process can be done using the following 3
169- commands (replacing all 9 occurrences of ` x.y.z ` with the version that
170- you want to check, see Maven Central badge above for the latest):
169+ commands:
171170
172171``` bash
173- curl -s -S ' https://repo1.maven.org/maven2/org/leplus/ristretto/x.y.z /ristretto-x.y.z .jar' -o ristretto-x.y.z .jar
174- curl -s -S ' https://repo1.maven.org/maven2/org/leplus/ristretto/x.y.z /ristretto-x.y.z .jar.sigstore.json' -o ristretto-x.y.z .jar.sigstore.json
175- cosign verify-blob --bundle ristretto-x.y.z .jar.sigstore.json --certificate-identity ' https://github.com/leplusorg/ristretto/.github/workflows/publish.yml@refs/tags/vx.y.z ' --certificate-oidc-issuer ' https://token.actions.githubusercontent.com' ristretto-x.y.z .jar
172+ curl -s -S ' https://repo1.maven.org/maven2/org/leplus/ristretto/2.0.0 /ristretto-2.0.0 .jar' -o ristretto-2.0.0 .jar
173+ curl -s -S ' https://repo1.maven.org/maven2/org/leplus/ristretto/2.0.0 /ristretto-2.0.0 .jar.sigstore.json' -o ristretto-2.0.0 .jar.sigstore.json
174+ cosign verify-blob --bundle ristretto-2.0.0 .jar.sigstore.json --certificate-identity ' https://github.com/leplusorg/ristretto/.github/workflows/publish.yml@refs/tags/v2.0.0 ' --certificate-oidc-issuer ' https://token.actions.githubusercontent.com' ristretto-2.0.0 .jar
176175```
177176
178177The only output that you should get is a message saying ` Verified OK ` .
@@ -186,16 +185,14 @@ Having GPG signature is a requirement to publish artifacts to Maven Central. You
186185- [ Maven] ( https://www.simplify4u.org/pgpverify-maven-plugin/ )
187186- [ Gradle] ( https://docs.gradle.org/current/userguide/dependency_verification.html )
188187
189- To verify only Ristretto, you can run the following command (replacing
190- ` x.y.z ` with the version that you want to check, see Maven Central
191- badge above for the latest) and check that the displayed keyId matches
192- the public key mentioned above:
188+ To verify only Ristretto, you can run the following command and check
189+ that the displayed keyId matches the public key mentioned above:
193190
194- ` mvn org.simplify4u.plugins:pgpverify-maven-plugin:show -Dartifact=org.leplus:ristretto:x.y.z `
191+ ` mvn org.simplify4u.plugins:pgpverify-maven-plugin:show -Dartifact=org.leplus:ristretto:2.0.0 `
195192
196193You can also use my convenient docker image (shameless plug):
197194
198- ` docker run --rm leplusorg/pgp-verify-jar org.leplus:ristretto:x.y.z `
195+ ` docker run --rm leplusorg/pgp-verify-jar org.leplus:ristretto:2.0.0 `
199196
200197See [ here] ( https://github.com/leplusorg/docker-pgp-verify-jar ) for details.
201198
0 commit comments