gary-rowe / bitcoinjenforcerrules

⚠️ OBSOLETE. DO NOT USE! Verifies Maven SHA1 hashes against a known list to deter dependency-chain attack vectors

Hello, I'm Gary 👋

Developer, Director, Dad

For the past 30 years I’ve been a professional developer in a variety of languages. I’ve worked in a wide variety of sectors including aviation, telecommunications, government, distributed ledger, charity, financial and so on.

While I’m able to design a reasonable user interface I much prefer to work on back end and low-level systems.

You might want to take a look at my hid4java project or review my blog.

bitcoinjenforcerrules's Issues

Whitelist is not a whitelist

A whitelist should block all, unless present on list.
As a blacklist should allow all, unless present on list.

If a dependency is missing from the list, the DigestRule does not break the build.
Large projects have lots of depenencies.
Forgetting to add one to the list creates security risks, as these are not checked for valid signatures.

URN list outside pom

My poms are already overcrowded with configuration.
Adding a big list of URNs is not very convenient.
Is it possible to add a functionality to read the URN-list from a dependency or a resource file from classpath?

Ensure that actual dependencies are compared rather than listed

Spotted by Andreas Shildbach:

At present if dependencies are changed without a fresh snapshot being taken then the enforcer rules will only be applied against the whitelist.

The enforcer needs to be stricter to avoid a false sense of security