anchor.diff:  === Cleaning up the verification file
   
   The dependency verification metadata file can grow up easily.
  -Gradle will not automatically remove _unused_ dependencies from this file.
  +Gradle will not automatically remove _unused_ entries from this file.
   The reason is that there's no way for Gradle to know upfront if a dependency will effectively be used during the build or not.
   
   As a consequence, adding dependencies or changing dependency version can easily lead to more entries in the file, while leaving unnecessary entries out there.
  
positive.code: 
  [[sec:bootstrapping-signature-verification]]
  === Bootstrapping and signature verification
  
  Similarly to bootstrapping for checksums, Gradle provides a convenience for bootstrapping a configuration file with signature verification enabled.
  For this, just add the `pgp` option to the list of verifications to generate.
  However, because there might be verification failures, missing keys or missing signature files, you **must** provide a fallback checksum verification algorithm:
  
  
  ----
  ./gradlew --write-verification-metadata pgp,sha256
  
negative.code: With such a minimal configuration file, a project using _any_ external dependency or plugin would immediately start failing because it doesn't contain any checksum to verify.
  
  A dependency verification configuration is _global_: a single file is used to configure verification of the whole build.
  In particular, the same file is used for both the (sub)projects and `buildSrc`.
  
  An easy way to get started is therefore to generate the minimal configuration for an existing build.
  
  