zapretdiscordyoutube/magisk-zapret2
Watch
1
6
Fork
You've already forked magisk-zapret2
 0
Code Issues 1 Pull requests Projects Releases 1 Packages Wiki Activity Actions
magisk-zapret2/docs/DEPENDENCY_TRUST.md
loop-uh f27db1f109 the big penis
2026-07-22 13:50:44 +03:00

2.1 KiB
Raw Permalink Blame History

Android dependency trust

The Android build uses Gradle dependency locking and strict SHA-256 dependency verification. app/gradle.lockfile pins the resolved module versions for every configuration exercised by the debug/test/lint and release graphs, while gradle/verification-metadata.xml authenticates the exact artifact and metadata bytes, including build plugins.

The reviewed least-privilege graph currently contains 345 locked dependency entries (344 modules plus Gradle's empty-configuration sentinel) across the resolved configurations and 585 verified components / 956 artifacts. Every artifact has exactly one SHA-256. The expected file hashes are:

  • app/gradle.lockfile: DAE2B81B1EBB5FEF7DFFB20BD838648E2B068A578AEE81A239BCA140E131AEEB
  • gradle/verification-metadata.xml: A078F6BC9E01B0F02009C3483F0662ACBC19E5A207FDDCDA1D8BED4D5FE65A61

Normal builds must not use --write-locks or --write-verification-metadata. CI passes --dependency-verification=strict explicitly. Gradle's strict verification mode is also the default whenever verification metadata is present.

Intentional regeneration

Regenerate both files only after reviewing an intentional dependency or build-plugin change, from a clean trusted network and repository state:

./gradlew testDebugUnitTest lintRelease assembleDebug --refresh-dependencies \
  --write-locks --write-verification-metadata sha256 \
  --no-parallel --no-configuration-cache --no-daemon

Review every changed component, version, artifact name, and checksum before commit. The refresh is required so Gradle authenticates repository metadata again instead of silently reusing already-parsed descriptors from a local cache. Regenerate from an empty metadata file when dependencies were removed; Gradle appends new checksums but does not prune obsolete components from an existing file. Then run the same graph without either write flag and with --dependency-verification=strict; repeat with --offline to prove the checked-in locks and metadata are sufficient. Never add blanket trusted-artifact patterns, disable metadata verification, or switch CI to lenient/off verification.