Update verification metadata task to trim unused entries.

build-logic/plugins/src/main/java/UpdateVerificationMetadataTask.kt

@@ -0,0 +1,79 @@
+/*
+ * Copyright 2026 Signal Messenger, LLC
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+import org.gradle.api.DefaultTask
+import org.gradle.api.file.DirectoryProperty
+import org.gradle.api.file.RegularFileProperty
+import org.gradle.api.provider.ListProperty
+import org.gradle.api.tasks.Internal
+import org.gradle.api.tasks.TaskAction
+import org.gradle.process.ExecOperations
+import org.gradle.work.DisableCachingByDefault
+import java.nio.charset.StandardCharsets
+import javax.inject.Inject
+
+/**
+ * Rebuilds dependency verification components from the dependencies resolved by the build.
+ *
+ * Gradle only adds entries when --write-verification-metadata is used, so starting with an empty
+ * components section is what removes entries for dependencies that are no longer used. The
+ * configuration section is retained, including its trusted-artifact rules.
+ */
+@DisableCachingByDefault(because = "This task updates Gradle's dependency verification metadata")
+abstract class UpdateVerificationMetadataTask
+@Inject
+constructor(
+  private val execOperations: ExecOperations
+) : DefaultTask() {
+  @get:Internal
+  abstract val metadataFile: RegularFileProperty
+
+  @get:Internal
+  abstract val rootDirectory: DirectoryProperty
+
+  @get:Internal
+  abstract val wrapperCommand: ListProperty<String>
+
+  @TaskAction
+  fun update() {
+    val file = metadataFile.get().asFile
+    val original = file.readBytes()
+
+    try {
+      val metadata = original.toString(StandardCharsets.UTF_8)
+      val components = Regex("(?s)(<components>).*?(</components>)")
+      check(components.findAll(metadata).count() == 1) {
+        "Expected exactly one <components> section in ${file.absolutePath}"
+      }
+
+      file.writeText(
+        components.replace(metadata) { match ->
+          "${match.groupValues[1]}\n   ${match.groupValues[2]}"
+        },
+        StandardCharsets.UTF_8
+      )
+
+      // The qa build resolves everything a clean qa run needs, including tooling that is only pulled while a
+      // task executes -- the KSP compiler, the aapt2 executable, and the layoutlib screenshot renderer all come
+      // in through detached configurations. Finally the cross-platform sync fills in aapt2's other OS variants.
+      runGradle("--write-verification-metadata", "sha256", "qa")
+      // The build-logic precompiled-script-plugin accessors are generated by applying each plugin in throwaway
+      // nested builds, which resolve plugin dependencies (e.g. junit BOMs) that no configuration walk or qa build
+      // ever sees. Forcing a refresh re-downloads them through the verifier so their checksums get written.
+      runGradle("--write-verification-metadata", "sha256", ":build-logic:plugins:generatePrecompiledScriptPluginAccessors", "--rerun-tasks", "--no-build-cache", "--refresh-dependencies")
+      runGradle("--write-verification-metadata", "sha256", "syncCrossPlatformVerification", "--rerun-tasks")
+    } catch (failure: Throwable) {
+      file.writeBytes(original)
+      throw failure
+    }
+  }
+
+  private fun runGradle(vararg arguments: String) {
+    execOperations.exec {
+      workingDir(rootDirectory.get().asFile)
+      commandLine(wrapperCommand.get() + arguments)
+    }
+  }
+}