How to stop the ‘Gradle Snatchers’: Securing your builds from baddies
summary
Shows how Gradle dependency verification actually works: generate verification-metadata.xml, use SHA-256 checksums and PGP signatures to catch impostors like the 2018 “fake Wharton” JCenter packages that injected code, and use repository filtering to force origins (requires Gradle 7+). Explains verifying the Gradle wrapper and distribution via distributionSha256Sum, points to GitHub Actions or a CI script to scan the ~3 million wrapper jars on GitHub, and recounts a Minecraft incident where a modified wrapper jar backdoored CI to get server root access.
AI-written summary · about
chapters (14)
- 0:00Introduction to talk
- 1:31Supply chain attacks overview
- 4:43Gradle’s evolution and history
- 5:03Confusing dependency story
- 9:12Verifying dependencies in Gradle
- 16:54Signature verification for provenance
- 20:22Pros and cons of dependency verification
- 21:46Repository filtering in Gradle
- 25:35First Gradle wrapper exploit story
- 29:32Verifying Gradle wrapper integrity
- 31:57Verifying Gradle distribution
- 34:03Checking Gradle W file security
- 35:27Summary and recommendations
- 36:30Additional resources and Q&A
related talks
36mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
37mHow to stop the ‘Gradle Snatchers’: Securing your builds from baddies
46mProtecting Your Organization from Build-system Attacks
39mI have no idea what my app is doing
44mSecuring the Supply Chain for Your Java Applications
47mDefending Your Users
41mPreparing for Supply Chain Attacks
51mProtecting your organisation against attacks via the build system