Preparing for Supply Chain Attacks

Supply chain attacks have been on the rise in recent years. In this session, we will discuss the safe operation of libraries and vulnerability management of Android projects using Gradle with focusing on the following topics: 1. Signature verification of libraries in Gradle - How to set up dependency verification - Dependency Locking and Transitive Version management 2. Preparation for actual attacks - Library management and vulnerability notification using external tools such as Dependabot and Renovate - How to prepare using GitHub Actions The goal of this session is to learn how to defend against supply chain attacks in android projects using Gradle. Keywords: Gradle, PGP, signature, SLSA, SBOM (Translated by the DroidKaigi Committee)

• 

  RyuNen344 android app developer