From 1cfae44aec10917b525498b3560a464db32492e0 Mon Sep 17 00:00:00 2001
From: Hans-Christoph Steiner <hans@eds.org>
Date: Thu, 2 Jan 2020 19:46:54 +0100
Subject: [PATCH] only download from jCenter as a last resort

"Artifact integrity verification aside, not only should jcenter() always be
last, but you need to put mavenCentral() before them. JCenter and Bintray
keep proving they're not a trustworthy artifact host. Ideally you fetch
nothing from them."
https://twitter.com/JakeWharton/status/1073102730443526144

https://blog.autsoft.hu/a-confusing-dependency/
---
 build.gradle | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/build.gradle b/build.gradle
index 30be214f4..f3bdc57f5 100644
--- a/build.gradle
+++ b/build.gradle
@@ -1,7 +1,8 @@
 buildscript {
     repositories {
+        mavenCentral()
         maven { url 'https://maven.google.com/' } // :-| must be before jcenter()
-        jcenter()
+        jcenter() // download from jCenter as last resort https://blog.autsoft.hu/a-confusing-dependency
     }
     dependencies {
         classpath 'com.android.tools.build:gradle:3.1.1'
@@ -9,7 +10,8 @@ buildscript {
 }
 allprojects {
     repositories {
+        mavenCentral()
         maven { url 'https://maven.google.com/' } // :-| must be before jcenter()
-        jcenter()
+        jcenter() // download from jCenter as last resort https://blog.autsoft.hu/a-confusing-dependency
     }
 }