signalapp / gradle-witness

A gradle plugin that enables static verification for remote dependencies.
MIT License
228 stars 60 forks source link

Witness incorrectly resolves dependency when older version is specified #29

Open duggulous opened 5 years ago

duggulous commented 5 years ago

Witness currently resolves the dependency file with the following code:

ResolvedArtifact dependency = project.configurations.compile.resolvedConfiguration.resolvedArtifacts.find{
     return it.name.equals(name) && it.moduleVersion.id.group.equals(group)
}

Because this only checks the group and name, and not version, this resolves the most recent version of that dependency in the cache. If you have more than one version in your cache and you are not using the newest one, you may be getting false negatives, because the plugin is not checking the file you are using.

This can also cause false positives if you calculate & record your checksum before adding a newer version of the dependency to your cache because Witness will compare the hash of the most recent version to the hash you recorded from the older version.