signalapp/gradle-witness
View on GitHub ↗ ★ 231 Groovy archived
A gradle plugin that enables static verification for remote dependencies.
3 mentions on Hacker News by 3 people: 0 stories, 3 comments · first 2014-07-28 · latest 2017-08-02
20082026
-
So you use https://github.com/whispersystems/gradle-witness , and you manually verify everything you whitelist right? And you never typo, right?
comment by raggi · 2017-08-02 · in Malicious crossenv package on npm -
…NPM over this is silly. Maven has this problem (people really concerned built their own tools: https://github.com/whispersystems/gradle-witness ), choclatey has this problem, pip has this problem, everyone has this problem . The big…
comment by KirinDave · 2017-08-01 · in Malicious crossenv package on npm -
…but also because dependencies could be compromised if the gradle/maven repository were compromised: https://github.com/whispersystems/gradle-witness It allows you to "pin" dependencies by specifying the sha256sum of the jar you're…
comment by moxie · 2014-07-28 · in How to take over the computer of a Maven Central user