Hurdle with mill adoption at our organization

[naga-zoom]

We're interested in adopting Mill but face two critical blockers:

1. Security Verification:

Mill uses Coursier for dependency resolution, but we need clarity on:

• Checksum verification support
• Signature verification support
• Configuration documentation

Our current tools (Maven and Gradle) provide built-in dependency verification that meets our security requirements.

2. SCA Tool Compatibility:

We use Mend for Software Composition Analysis in our CI pipeline. Mend doesn't currently support Mill, blocking our compliance requirements. We've requested this feature from Mend but have no timeline.
Request:

• Does Mill/Coursier support checksum and signature verification?
• How do we configure these features?
• Any guidance on SCA tool integration?

These issues prevent us from adopting Mill despite our interest in the tool.

github issue: #6509

[naga-zoom]

duplicate: #6510