Preparing for Supply Chain Attacks
summary
Covers protecting Android projects against supply-chain attacks by showing concrete Gradle practices: how to verify library signatures (PGP), configure dependency verification, manage Dependency Locking and transitive versions, and generate SBOM/SLSA-related artifacts. Also explains operational defenses using tools like Dependabot or Renovate for vulnerability alerts and using GitHub Actions to automate those protections.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 1:05Supply chain attacks
- 2:08Attack examples and damage
- 4:16Industry efforts and basics
- 7:08App development basics
- 8:54Gradle verification
- 10:41Maven Central structure
- 13:30PGP signature verification
- 16:23Repository signing status
- 17:04Repository content filtering
- 19:33Setup examples
- 21:37Gradle wrapper verification
- 23:01Repository filtering settings
- 24:45Dependency verification activation
- 25:47Verification metadata XML
- 27:57Checksum verification automation
- 30:25Metadata verification activation
- 31:09Signature verification setup
- 34:22Verification settings examples
- 34:45Dependabot and GitHub Actions
- 35:28Automated verification with GitHub Actions
- 37:12Generating and using SBOM
- 38:38Summary and future
- 40:48Security importance review
- 41:09Q&A
related talks
46mProtecting Your Organization from Build-system Attacks
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
34mFrom development to release: Protecting the software supply chain
15mSupply chain security for dummies
37mSupply Chain Attacks and the Future of Software Delivery
14mSupply Chain Security, why should I care?
42mProtecting Your GitHub from Supply Chain Attacks
49mMitigate Risks In Code: Protect Your Software based Supply Chain