Fetching remote artifacts without verifying their authenticity and integrity can introduce malicious code into build environments and applications.

Why is this an issue?

Remote artifacts are files or packages fetched from external sources during a build or deployment process. Without verifying their authenticity (who created them) and integrity (whether they have been modified), there is no guarantee that the artifact is legitimate. An attacker who replaces a remote artifact — whether on the publisher’s server, in transit, or in a local cache — can introduce malicious code that executes with the same trust as the original.

In a Gradle project, dependency verification is enabled by creating a verification-metadata.xml file in the gradle directory. Calling disableDependencyVerification() in a resolution strategy explicitly disables this check. The absence of a verification-metadata.xml file in the gradle directory of a project will also result in Gradle not verifying the integrity of dependencies.

What is the potential impact?

Supply chain compromise

If a remote artifact is tampered with before or after it is published, an attacker can inject malicious code into the build environment or the resulting deployments. This can expose sensitive data such as build secrets and source code, allow modification of runtime data, or produce a compromised artifact that is distributed to end users.

How to fix it

Code examples

Use ./gradlew --write-verification-metadata pgp,sha256 --export-keys to bootstrap a verification-metadata.xml file with PGP key IDs and SHA256 checksums. Verify the identity of all publisher keys in the exported keyring. If you cannot verify publisher identities, fall back on checksum-based integrity verification.

Noncompliant code example

dependencies {
    implementation("com.example:adependency:1.0")
}

configurations {
    all {
        resolutionStrategy {
            disableDependencyVerification() // Noncompliant: dependency verification is disabled
        }
    }
}

Compliant solution

dependencies {
    implementation("com.example:adependency:1.0")
}

<verification-metadata
    xmlns="https://schema.gradle.org/dependency-verification"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="https://schema.gradle.org/dependency-verification https://schema.gradle.org/dependency-verification/dependency-verification-1.3.xsd">
   <configuration>
      <verify-metadata>true</verify-metadata>
      <verify-signatures>true</verify-signatures>
      <keyring-format>armored</keyring-format>
      <trusted-keys>
         <trusted-key id="FD8190C7D72E7DCD42582B1042677B9FC1DC2161" group="com.example" name="adependency"/>
      </trusted-keys>
   </configuration>
</verification-metadata>

Resources

Documentation

Standards

Related rules