[AURORA-616] Consider using gradle-witness to verify dependencies

• Type: Story
• Status: Resolved
• Priority: Trivial
• Resolution: Won't Fix
• Component/s: Build, Scheduler, Security
• Labels: newbie
• Assignee: Unassigned
• Reporter: Bill Farner
• Created: 29/Jul/14 03:36
• Updated: 08/Sep/19 21:35
• Resolved: 28/Dec/15 02:21

Description

gradle-witness [1] aims to provide insulation against MITM attacks via maven dependency downloads. From the looks of things, it would require a pretty small amount of upfront work and upkeep to integrate this and prevent injection of rogue code.

[1] https://github.com/whispersystems/gradle-witness

Issue Links

• is cloned by: AURORA-1997 Consider using checksum-dependency-plugin for dependency verification
• is related to: AURORA-618 Pin cryptographic checksums of python requirements
• is related to: AURORA-620 Consider using JCenter over HTTPS instead of Maven Central