In Maven, there exists:
How can one via gradle verify the signature of a downloaded artifact? Are there plugins available that already do this? Should we write one? Does gradle offer a way to verify?
There is gradle-witness plugin. Unfortunately it seems to be not actively developed anymore and there are some pending issues (like support for buildscript dependencies verification).
Anyway artifacts consistency does not seem to be high on the Gradle team priority list. There is an ability to verify sha256 signature of downloaded distribution (contributed by the community), but the official checksum for published distributions are not available (not to mention its OpenPGP/GPG signing).
I did give the witness plugin a try. It seems to only verify checksums against a preconfigured set of hash values. It does not quite deal with PGPs at all. Right?
Yes, you are completely right. I misread the question.
Anyway I wonder what kind of attack would you like to prevent? Binary artifact modification by the rogue Maven mirror?
Yes, exactly. I was sort of inspired by this article here:
http://branchandbound.net/blog/security/2012/08/verify-dependencies-using-pgp/
…where there is a fair amount of good discussion on cross-build injection attacks.
I did look around, and found nothing that might do what the maven equivalent does. I might port a simplified version of the plugin over and use it for CAS (https://github.com/apereo/cas) but thought to check here and see if there are better ways of doing this.
See also this related Stackoverflow question and answer. Disclaimer: The answer is by me.
GitHub - vlsi/vlsi-release-plugins: A set of plugins to simplify Gradle release tasks can verify PGP signatures and/or checksums for the plugins and dependencies.
Is there any way to verify only a specific artifact instead of all??