AS: Include distributionSha256Sum in gradle/wrapper/gradle-wrapper.properties [37126714]

Obsolete

Feature Request

Status Update

No update yet.

Description

mm...@commonsware.com

created issue #1

Nov 15, 2016 03:09PM

For the AS-generated Gradle Wrapper, include the distributionSha256Sum property, with the SHA256 hash matching the ZIP archive from the distributionUrl.

This requires

issue 36949180

to be addressed as well, as AS 2.2.2 crashes when the hash does not match the ZIP.

This hash helps prevent some MITM attacks, whereby a malicious actor would replace the downloaded Gradle wrapper ZIP file with a hacked version.

Thanks!

Comments

mm...@commonsware.com <mm...@commonsware.com> #2Jul 28, 2018 07:48PM

I guess hidden should just be defined. Meaning, right now, hidden should just defined as "whether this fragment was hidden as part of a transaction". Hidden is not equivalent with visibility. I think that's where the confusion comes from.

sa...@google.com <sa...@google.com> #3May 19, 2020 03:54PM

Status: Won't Fix (Obsolete)

We have passed this to the development team and will update this issue with more information as it becomes available.

Issue 37126714

Description

Issue summary

Comments

mm...@commonsware.com <mm...@commonsware.com> #2Jul 28, 2018 07:48PM

sa...@google.com <sa...@google.com> #3May 19, 2020 03:54PM

Add comment

Issue metadata