Mirrors
/
open-keychain
mirror of https://github.com/open-keychain/open-keychain.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Page: Build Security
Pages
API Design Alternative Passphrase Methods App Security Backups Build Security Competing Apps Database Design Google Summer of Code 2014 Google Summer of Code 2015 Google Summer of Code 2016 Home Icons and Colors Intents Keyserver less OpenPGP Language Conventions OpenPGP Key Transfer OpenPGP Security Paper QR Codes Release Management Secure OpenPGP Key Pair Synchronization via IMAP Security Tokens Test URLs Vulnerabilities cure53 Security Audit 2015
2 Build Security
Dominik Schürmann edited this page 2015-06-16 00:08:40 +02:00
  1. On execution of ./gradlew build, the gradle wrapper downloads the actually required gradle version. This download is protected by SHA-256 verification integrated by us into Gradle Wrapper (see gradle/wrapper/gradle-wrapper.properties).
  2. All dependencies are either included as git submodules or downloaded from JCenter. JCenter dependencies are verified using SHA-256 by Gradle Witness (see OpenKeychain/build.gradle).

TODO?: buildscript dependency verification?