3 ms·

> I like that it downloads itself via wrapper script. While I also use and enjoy Gradle, this is IMO its biggest weakness. We've all seen the recent supply-cha

by tn1 6y ago

> I like that it downloads itself via wrapper script. While I also use and enjoy Gradle, this is IMO its biggest weakness. We've all seen the recent supply-chain attacks, and ~everyone's infra is at risk here. There isn't even anything similar to Javascript's subresource integrity! I'm sure that the people hosting Gradle are very cautious, but it only takes one slip-up...

jpgvm 6y ago
They could add a signature check to the wrapper script to resolve this concern.
- fcurts 6y ago
  It already exists: https://docs.gradle.org/current/userguide/gradle_wrapper.html#sec:verification https://docs.gradle.org/current/userguide/gradle_wrapper.htm...
  - jpgvm 6y ago
    Huh I didn't know this existed, I will enable this now. :D
  - tn1 6y ago
    Huh, TIL. Still, it doesn't seem to be enabled by default on new projects (although I only tried in Android Studio, several months ago)