Hurdle with mill adoption at our organization

[naga-zoom]

We're interested in adopting Mill but face two critical blockers:

1. Security Verification:

Mill uses Coursier for dependency resolution, but we need clarity on:

• Checksum verification support
• Signature verification support
• Configuration documentation
  Our current tools (Maven and Gradle) provide built-in dependency verification that meets our security requirements.

2. SCA Tool Compatibility:

• We use Mend for Software Composition Analysis in our CI pipeline. Mend doesn't currently support Mill, blocking our compliance requirements. We've requested this feature from Mend but have no timeline.

Request:

• Does Mill/Coursier support checksum and signature verification?
• How do we configure these features?
• Any guidance on SCA tool integration?

These issues prevent us from adopting Mill despite our interest in the tool.

[lihaoyi]

@alexarchambault could you answer the questions about Checksum and Signature verification? Is that on by default?

@naga-zoom I don't know anything about your SCA tool unfortunately, so you may have to ask Mend to look into it or figure out the integration yourself

[lefou]

Upstream issue:

• Clarification needed on checksum and signature verification capabilities coursier/coursier#3543

[alexarchambault]

Answered in the corresponding coursier issue