From 492e66e78abf516ee46bd9ce97e2ea097961f4cf Mon Sep 17 00:00:00 2001 From: Chris Conlon Date: Tue, 11 Aug 2026 15:32:44 -0600 Subject: [PATCH] F-8216: pin SHA-256 checksums for Android Gradle build dependencies --- IDE/Android/README.md | 30 + .../update-verification-metadata.gradle | 70 + IDE/Android/gradle/verification-metadata.xml | 1958 +++++++++++++++++ 3 files changed, 2058 insertions(+) create mode 100644 IDE/Android/gradle/update-verification-metadata.gradle create mode 100644 IDE/Android/gradle/verification-metadata.xml diff --git a/IDE/Android/README.md b/IDE/Android/README.md index 9778c883..ad58a917 100644 --- a/IDE/Android/README.md +++ b/IDE/Android/README.md @@ -142,6 +142,36 @@ project located in the wolfcrypt-jni/IDE directory. This will ask for permissions to access the certificates in the /sdcard/ directory and then print out the server certificate information on success. +## Gradle Dependency Verification + +This project pins SHA-256 checksums for all remotely downloaded Gradle build +dependencies in `gradle/verification-metadata.xml`. Gradle enforces these +automatically on every build because the file is present. If an artifact +downloaded from a repository does not match its pinned checksum, the build +fails. The Gradle distribution itself is separately pinned via +`distributionSha256Sum` in `gradle/wrapper/gradle-wrapper.properties`. + +When changing the Android Gradle Plugin version or any dependency version, the +metadata file must be regenerated from a trusted network environment: + +``` +cd IDE/Android +./gradlew -I gradle/update-verification-metadata.gradle \ + --write-verification-metadata sha256 help +``` + +The `update-verification-metadata.gradle` init script captures artifacts that +the Android Gradle Plugin only resolves while tasks execute (AAPT2 and the +Unified Test Platform used by instrumented tests). These would otherwise be +missing from the regenerated file and would fail verification during CI builds. +The version coordinates inside that init script must be updated to match the +new Android Gradle Plugin version, as described in the comments at the top of +the script. + +Review the diff of `gradle/verification-metadata.xml` before committing an +update, and confirm new checksums come from a trusted build of the upstream +artifacts. + ## Support Please contact wolfSSL support at support@wolfssl.com with any questions or diff --git a/IDE/Android/gradle/update-verification-metadata.gradle b/IDE/Android/gradle/update-verification-metadata.gradle new file mode 100644 index 00000000..437e4baa --- /dev/null +++ b/IDE/Android/gradle/update-verification-metadata.gradle @@ -0,0 +1,70 @@ +/* + * update-verification-metadata.gradle + * + * Helper init script used when regenerating the Gradle dependency + * verification metadata file (gradle/verification-metadata.xml). + * + * The Android Gradle Plugin resolves some artifacts only while a task is + * executing, not at configuration time. Those artifacts are missed by the + * normal bootstrap command and would fail dependency verification later, for + * example AAPT2 during assemble tasks and the Unified Test Platform (UTP) + * stack during connectedDebugAndroidTest. This script declares those artifacts + * in regular configurations so the bootstrap records them. All three AAPT2 + * platform classifiers are captured so Linux CI, macOS, and Windows developer + * machines all pass verification. + * + * Usage, from the IDE/Android directory: + * + * ./gradlew -I gradle/update-verification-metadata.gradle \ + * --write-verification-metadata sha256 help + * + * Review the resulting gradle/verification-metadata.xml diff before + * committing it. + * + * When the Android Gradle Plugin version changes, update the + * versions below to match the new plugin: + * + * - aapt2: version is "-". Read it + * from aapt2_version.properties inside the AGP jar: + * unzip -p \ + * com/android/build/gradle/internal/res/aapt2_version.properties + * - com.android.tools.utp artifacts: version is the AGP version + * plus 23 in the major number (AGP 8.3.1 -> 31.3.1). + * - com.google.testing.platform artifacts: version comes from the + * UtpDependency class in the AGP jar. It also appears as the + * core-proto version pulled in by the normal bootstrap. + */ +gradle.allprojects { project -> + if (project.name != 'app') { + return + } + def coords = [ + 'com.android.tools.build:aapt2:8.3.1-10880808:linux', + 'com.android.tools.build:aapt2:8.3.1-10880808:osx', + 'com.android.tools.build:aapt2:8.3.1-10880808:windows', + 'com.google.testing.platform:launcher:0.0.9-alpha02', + 'com.google.testing.platform:core:0.0.9-alpha02', + 'com.google.testing.platform:android-driver-instrumentation:' + + '0.0.9-alpha02', + 'com.google.testing.platform:android-test-plugin:0.0.9-alpha02', + 'com.android.tools.utp:android-device-provider-ddmlib:31.3.1', + 'com.android.tools.utp:android-device-provider-gradle:31.3.1', + 'com.android.tools.utp:android-test-plugin-host-device-info:31.3.1', + 'com.android.tools.utp:android-test-plugin-host-additional-' + + 'test-output:31.3.1', + 'com.android.tools.utp:android-test-plugin-host-apk-installer:31.3.1', + 'com.android.tools.utp:android-test-plugin-host-coverage:31.3.1', + 'com.android.tools.utp:android-test-plugin-host-logcat:31.3.1', + 'com.android.tools.utp:android-test-plugin-host-emulator-' + + 'control:31.3.1', + 'com.android.tools.utp:android-test-plugin-host-retention:31.3.1', + 'com.android.tools.utp:android-test-plugin-result-listener-' + + 'gradle:31.3.1', + ] + coords.eachWithIndex { coord, idx -> + def cfg = project.configurations.create("verifyMetadataCapture${idx}") + cfg.canBeConsumed = false + cfg.transitive = true + project.dependencies.add(cfg.name, coord) + } +} diff --git a/IDE/Android/gradle/verification-metadata.xml b/IDE/Android/gradle/verification-metadata.xml new file mode 100644 index 00000000..26f15ee2 --- /dev/null +++ b/IDE/Android/gradle/verification-metadata.xml @@ -0,0 +1,1958 @@ + + + + true + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +