[AURORA-1997] Consider using checksum-dependency-plugin for dependency verification

• Type: Story
• Status: Closed
• Priority: Trivial
• Resolution: Later
• Component/s: Build, Scheduler, Security
• Labels: newbie
• Assignee: Unassigned
• Reporter: Vladimir Sitnikov
• Created: 08/Sep/19 21:28
• Updated: 26/Dec/19 20:29
• Resolved: 26/Dec/19 20:29

Description

checksum-dependency-plugin [1] is a superset of gradle-witness, and it enables to increase the level of security.

Key features:

• Gradle plugins can be verified (grade-witness doesn't track plugins)
• All Gradle configurations are supported (e.g. `java-library` plugin is supported). `checksum-dependency-plugin` intercepts detached configurations as well (e.g. the ones that are created on demand)
• PGP can be used for verification. PGP can be used with or without checksum. PGP enables to detect and prevent issues like https://blog.autsoft.hu/a-confusing-dependency/

checksum-dependency-plugin aims to provide insulation against MITM attacks via maven dependency downloads.
It is trivial to integrate, and it is not that hard to maintain (e.g. updated checksum.xml could be updated automatically)

[1] https://github.com/vlsi/vlsi-release-plugins/tree/master/plugins/checksum-dependency-plugin

Issue Links

• is a clone of: AURORA-616 Consider using gradle-witness to verify dependencies