How to stop the ‘Gradle Snatchers’: Securing your builds from baddies
summary
Covers real incidents: a 2018 repo spoofing where a malicious artifact impersonates a popular library, and a 2022 Gradle Wrapper compromise observed on a Minecraft server with ~290,000 players. Shows concrete mitigations: enable dependency verification (checksums and SHA-256), import PGP signatures and trust keys via verificationMetadata.xml, set a distributionSha256Sum on the wrapper, use Gradle’s repository filtering and a GitHub Action to verify wrapper JARs; these measures catch tampered artifacts and block wrapper/distribution swaps.
AI-written summary · about
chapters (10)
- 0:00Intro
- 0:28Introduction
- 8:23Dependency Verification
- 16:45Metadata Verification
- 17:15ASC File Verification
- 18:44Pros and Cons
- 24:27Minecraft
- 27:36Verification
- 31:31Pull via
- 35:03Conclusion
related talks
36mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
38mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
46mProtecting Your Organization from Build-system Attacks
39mI have no idea what my app is doing
47mDefending Your Users
51mProtecting your organisation against attacks via the build system
44mSecuring the Supply Chain for Your Java Applications
41mPreparing for Supply Chain Attacks