android / android/nowinandroid

[FR]: Gradle Repository Potential Security and Reproducibility Risk

Open
#1,558 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Kotlin
Stars
21.8k
Forks
4.6k
Avg merge
19h 20m
Merged PRs (30d)
2

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the problem

The current root `settings.gradle.kts` setup poses a potential security and reproducibility risk due to the unrestricted access to repositories. The order of repository declarations matters as [Gradle resolves dependencies in the order listed](https://docs.gradle.org/current/userguide/declaring_repositories.html#sec:repository-content-filtering), leading to unintended artifacts being included if not properly managed.

**Example Case:**
The `com.jraska.module.graph.assertion` artifact is found in `gradlePluginPortal()` but not in `mavenCentral()`. Without proper filtering, new artifacts in `mavenCentral()` could unintentionally break or alter the build.

**Current Configuration:**
```kotlin
pluginManagement {
repositories {
google()
mavenCentral()
gradlePluginPortal()
}
}
```

### Describe the solution

implement content filtering to restrict the scope of artifacts from each repository.

### Additional context

_No response_

### Code of Conduct

- [X] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Research direction

Start in the root settings.gradle.kts and read Gradle's repository content-filtering documentation linked in the issue. Define repository scopes that avoid unintended artifact resolution, then verify that the project still resolves its dependencies and builds reproducibly.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
build-system, security
Issue type
Refactor
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.