Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

insecure gradlew #25

Closed
IzzySoft opened this issue Oct 15, 2018 · 3 comments
Closed

insecure gradlew #25

IzzySoft opened this issue Oct 15, 2018 · 3 comments
Assignees

Comments

@IzzySoft
Copy link

Just a minor adjustment, but could you please fix the gradle conf:

Found plain HTTP URL for gradle repository:
build/org.secuso.privacyfriendlypasswordgenerator/app/build.gradle
repositories{
    maven {
        url 'http://dl.bintray.com/amulyakhare/maven'
    }
gradle build uses plain HTTP URLs for repositories!  This is insecure!
https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/
ERROR: Job failed: exit code 1

(fdroid build complains, pipeline breaks) Fix should be as easy as replacing http by https (URL works then) – but not being an Android dev I cannot verify that.

Thanks!

@IzzySoft
Copy link
Author

Thanks!

@Kamuno
Copy link
Member

Kamuno commented Mar 13, 2019

Just realized I didn't do it correctly the first time. Should be fixed now. I somehow assumed the Issue was about the checksum not being correct (which it wasn't) because "insecure gradlew" is the tag set for exactly this problem on fdroid.

Should be fixed now .. also increased the version number.

@IzzySoft
Copy link
Author

No, the problem I reported here was the plain http url which should be https. And that's fixed now with 46ea9d5 as I can see 😉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants