gradle-witness
gradle-witness copied to clipboard
signalapp
A gradle plugin that enables static verification for remote dependencies.
With databinding enabled in Android project build.gradle, gradle-witness data binding enabled via: ``` dataBinding { enabled = true } ``` output is: ``` FAILURE: Build failed with an exception. *...
When I add new dependency to my project and run `calculateChecksums` Then git diff should show me minimal differences. This can be achieved if dependencies are sorted by groupId and...
Since the whole gradle build process for Android relies on downloading plugins from jcenter, we really need a way to do what gradle-witness does, but for those plugins. @dschuermann already...
Issue: The Task.leftShift(Closure) method has been deprecated and is scheduled to be removed in Gradle 5.0. Fix: Use Task.doLast(Action) instead. Resolves: https://github.com/signalapp/gradle-witness/issues/22
Correct me if I'm wrong, but I don't think the pom/transient dependencies are verified. A malicious repo could edit a pom, add a new transient dependency without triggering a verification...
Hello moxie0, I have removed the deprecated LeftShift in calculateChecksums task to make gradle-witness compatible with gradle >= 5. It's just a syntactical change and shouldn't have any side effects....
I'm happy to submit a pull request for this issue asap.
Witness currently resolves the dependency file with the following [code](https://github.com/signalapp/gradle-witness/blob/10f1269c0aafdc1d478efc005ed48f3a47d44278/src/main/groovy/org/whispersystems/witness/WitnessPlugin.groovy#L34): ``` ResolvedArtifact dependency = project.configurations.compile.resolvedConfiguration.resolvedArtifacts.find{ return it.name.equals(name) && it.moduleVersion.id.group.equals(group) } ``` Because this only checks the group and name, and...
Gradle-witness only supports libraries added with "compile", but not "implementation". ```` WARNING: Configuration 'compile' is obsolete and has been replaced with 'implementation'. It will be removed at the end of...
