F-9123: enable Gradle dependency verification for IDE/Android example project

IDE/Android/README.md

@@ -3,14 +3,16 @@
 This is an example Android Studio project file for wolfssljni / wolfJSSE. This
 project should be used for reference only.
 
-Tool and version information used when testing this project:
+Tool and version information for this project, taken from `build.gradle`,
+`app/build.gradle`, `gradle/wrapper/gradle-wrapper.properties`, and the
+`.github/workflows/android_gradle.yml` CI workflow:
 
-- Ubuntu 20.04.3 LTS
-- Android Studio Chipmunk 2021.2.1
-- Android Gradle Plugin Version: 4.2.2
-- Gradle Version: 7.1.3
-- API 30: Android 11
-- Emulator: Pixel 5 API 31
+- Android Gradle Plugin Version: 8.3.1 (needs Android Studio Iguana
+  2023.2.1 or newer)
+- Gradle Version: 8.4
+- JDK 17 or newer (CI uses JDK 21)
+- compileSdk / targetSdk 33, minSdk 24
+- CI: Ubuntu (GitHub Actions ubuntu-latest), emulator API 30 x86_64
 
 The following sections outline steps required to run this example on an
 Android device or emulator.
@@ -123,6 +125,66 @@ This will print out the server certificate information on success.
 app->java->com.wolfssl->provider.jsse.test->WolfSSLJSSETestSuite and
 app->java->com.wolfssl->test->WolfSSLTestSuite.
 
+## Gradle Dependency Verification
+
+This project enables Gradle dependency verification. The file
+`gradle/verification-metadata.xml` holds SHA-256 checksums for the Android
+Gradle Plugin, every resolved dependency artifact, and their POM/module
+metadata files. Gradle checks each artifact it resolves against this list and
+fails the build if a checksum does not match or an artifact is not listed.
+Source and Javadoc JARs downloaded by Android Studio are trusted by pattern
+since they are never executed.
+
+If you change a dependency or plugin version in `build.gradle` or
+`app/build.gradle`, regenerate the file as follows.
+
+1. Delete the whole `<components>` block from
+   `gradle/verification-metadata.xml` and keep the `<configuration>` block.
+   `--write-verification-metadata` only adds entries and never removes
+   entries for versions that are no longer resolved, so without this step
+   stale entries accumulate and the diff only ever shows additions.
+
+2. Regenerate the checksums:
+
+```
+cd IDE/Android
+./gradlew --refresh-dependencies --write-verification-metadata sha256 \
+    help assembleDebug assembleDebugUnitTest assembleDebugAndroidTest \
+    assembleRelease connectedDebugAndroidTest
+```
+
+   `--refresh-dependencies` is required. Without it Gradle serves POM/module
+   metadata it already parsed from its cache without reading the files
+   again, so their checksums are not recorded and a fresh checkout (for
+   example CI) then fails verification. `connectedDebugAndroidTest` can be
+   run without a device attached. It fails with "No connected devices!" but
+   only after resolving the Android test platform (UTP) artifacts, so they
+   are still recorded.
+
+3. Add AAPT2 entries for the other platforms. Gradle only records artifacts
+   resolved on the host that ran the command, and the AAPT2 binary
+   (`com.android.tools.build:aapt2`) is OS specific. Find the AAPT2 version
+   Gradle recorded for your host in `gradle/verification-metadata.xml`, set
+   `V` to it, and run the snippet below. It downloads the JARs for all
+   platforms and prints ready to paste `<artifact>` entries. Paste the ones
+   for the platforms other than your host under the existing `aapt2`
+   component. These entries carry `origin="Downloaded from ..."` instead
+   of `origin="Generated by Gradle"`. Re-add them after every step 1.
+
+```
+V=8.3.1-10880808
+B=https://dl.google.com/dl/android/maven2/com/android/tools/build/aapt2
+for os in linux osx windows; do
+    curl -sSfO $B/$V/aapt2-$V-$os.jar
+    printf '         <artifact name="aapt2-%s-%s.jar">\n' $V $os
+    printf '            <sha256 value="%s" origin="Downloaded from %s"/>\n' \
+        $(shasum -a 256 aapt2-$V-$os.jar | cut -d ' ' -f 1) $B
+    printf '         </artifact>\n'
+done
+```
+
+4. Review the resulting diff and commit the updated file.
+
 ## Support
 
 Please contact wolfSSL support at support@wolfssl.com with any questions or