Android在Maven中使用github库是安全的

Question

I'm using a Gradle build system with Android Studio and have a couple of questions regarding the use of maven dependencies.

I'm using a library from github and I'm wondering if its safe to include it as a maven dependency, or if its better to include the library into the project a different way. What happens if the owner removes the library from github? Will my app cease to work? If so then is it better to just directly include the library in my project?

To be honest I'm still a bit unclear on the details of using repositories through maven and gradle, but I'd like to know the limitations of using a library this way.

I managed to implement a library by adding a JitPack repository to my build file build.gradle, but I'm worried about the possibility of the owner removing the library rendering the app unusable. Here's the following blocks of code that I used to implement the library:

repositories {
    maven { url "https://jitpack.io" }
}

dependencies {
    compile 'com.github.windyzboy:CustomEditor:v1.0.1'
}

Does this download the files and place it in my project, or is it referencing the library somehow? If the owner of the repository removes their library, will my app still be able to use it?

Answer 1

From Frequently Asked Questions

What happens if a tag or repository is deleted on GitHub?

If the project was already built then JitPack will continue serving the existing artifacts. It will not rebuild the project at the new tag. In case you need to redo a release the best option is to create a new version on GitHub.

From my experience it's only possible to delete a successful build for up to seven days. But I couldn't find any official documentation about it. But I guess everyone learned from the NPM disaster.

Just use it. Many do so. It's the only channel I use for publishing my own projects so far. Your only issue is the service going down. But that's a valid concern for any other service as well.