android / android/nowinandroid
[FR]: Gradle Repository Potential Security and Reproducibility Risk
- Dominant language
- Kotlin
- Stars
- 21.8k
- Forks
- 4.6k
- Avg merge
- 19h 20m
- Merged PRs (30d)
- 2
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the problem
The current root `settings.gradle.kts` setup poses a potential security and reproducibility risk due to the unrestricted access to repositories. The order of repository declarations matters as [Gradle resolves dependencies in the order listed](https://docs.gradle.org/current/userguide/declaring_repositories.html#sec:repository-content-filtering), leading to unintended artifacts being included if not properly managed.
**Example Case:**
The `com.jraska.module.graph.assertion` artifact is found in `gradlePluginPortal()` but not in `mavenCentral()`. Without proper filtering, new artifacts in `mavenCentral()` could unintentionally break or alter the build.
**Current Configuration:**
```kotlin
pluginManagement {
repositories {
google()
mavenCentral()
gradlePluginPortal()
}
}
```
### Describe the solution
implement content filtering to restrict the scope of artifacts from each repository.
### Additional context
_No response_
### Code of Conduct
- [X] I agree to follow this project's Code of Conduct
Contributor guide
Research direction
Start in the root settings.gradle.kts and read Gradle's repository content-filtering documentation linked in the issue. Define repository scopes that avoid unintended artifact resolution, then verify that the project still resolves its dependencies and builds reproducibly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- build-system, security
- Issue type
- Refactor
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100