How to stop the ‘Gradle Snatchers’: Securing your builds from baddies
summary
Example: a 2018 dependency from JCenter masquerades as Jake Wharton and adds INTERNET access, and a 2022 incident injects a malicious Gradle wrapper into a Minecraft server used by ~290,000 players. Use SHA-256 checksums and Gradle’s generated verification metadata to block tampered artifacts, add PGP/GPG signatures for provenance, apply Gradle wrapper verification (GitHub Action or distribution SHA-256 in gradle-wrapper.properties), and enforce repository filtering; failures break builds/CI so issues surface immediately.
AI-written summary · about
chapters (11)
- 0:00Introduction and welcome
- 1:07Supply chain attacks explained
- 4:57Confusing dependency story
- 9:30Dependency verification in Gradle
- 15:25Signature verification for libraries
- 21:45Repository filtering for security
- 23:50Minecraft server Gradle attack
- 27:01Verifying Gradle wrapper integrity
- 29:29Verifying Gradle distribution
- 31:56Unverified Gradle W file risks
- 33:19Summary and key takeaways
related talks
37mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
38mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
46mProtecting Your Organization from Build-system Attacks
39mI have no idea what my app is doing
47mDefending Your Users
51mProtecting your organisation against attacks via the build system
44mSecuring the Supply Chain for Your Java Applications
31mI have no idea what my app is doing ¯\_(ツ)_/¯ - Protecting your application from unintended side eff