anchor.diff:  
   In addition to <<sec:checksum-verification,checksums>>, Gradle supports verification of signatures.
   Signatures are used to assess the _provenance_ of a dependency (it tells who signed the artifacts, which usually corresponds to who produced it).
  -They are also used to assess the integrity of a dependency just like checksums.
  +
   While enabling signature verification usually means a higher level of security, you might want to replace checksum verification with signature verification.
  +
  +[WARNING]
  +====
  +Signatures _can_ also used to assess the integrity of a dependency similarly to checksums.
  +Signatures are signatures of the _hash_ of artifacts, not artifacts themselves.
  +This means that if the signature is done on an _unsafe hash_ (even SHA1), then you're not correctly assessing the _integrity_ of a file.
  +For this reason, if you care about both, you need to add both signatures _and_ checksums to your verification metadata.
  +====
   
   However:
   
   - Gradle only supports verification of signatures published on remote repositories as ASCII-armored PGP files
   - Not all artifacts are published with signatures
  +- A good signature doesn't mean that the signatory was legit
   
   As a consequence, signature verification will often be used alongside checksum verification.
   
  
positive.code: With such a minimal configuration file, a project using _any_ external dependency or plugin would immediately start failing because it doesn't contain any checksum to verify.
  
  A dependency verification configuration is _global_: a single file is used to configure verification of the whole build.
  
  An easy way to get started is therefore to generate the minimal configuration for an existing build.
  
  
negative.code:    <components>
        <component group="org.apache.pdfbox" name="pdfbox" version="2.0.17">
           <artifact name="pdfbox-2.0.17.jar">
              <sha512 value="7e11e54a21c395d461e59552e88b0de0ebaf1bf9d9bcacadf17b240d9bbc29bf6beb8e36896c186fe405d287f5d517b02c89381aa0fcc5e0aa5814e44f0ab331" origin="PDFBox Official site (https://pdfbox.apache.org/download.cgi)"/>
           </artifact>
           <artifact name="pdfbox-2.0.17.pom">
              <sha512 value="82de436b38faf6121d8d2e71dda06e79296fc0f7bc7aba0766728c8d306fd1b0684b5379c18808ca724bf91707277eba81eb4fe19518e99e8f2a56459b79742f" origin="Generated by Gradle"/>
  