Hardened Gradle builds with Gradle dependency verification and defined module restrictions on third-party maven repositories.

.github/workflows/build-release.yml

@@ -19,7 +19,7 @@ jobs:
           distribution: 'temurin'
           java-version: 17
       - name: Build artifacts
-        run: ./gradlew build -Pbuild.release=true
+        run: ./gradlew --dependency-verification strict build -Pbuild.release=true
       - name: Upload assets to GitHub
         uses: AButler/upload-release-assets@v2.0
         with:

.github/workflows/build-snapshot.yml

@@ -32,7 +32,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-build-snapshot-
       - name: Build artifacts
-        run: ./gradlew build
+        run: ./gradlew --dependency-verification strict build
       - name: Upload artifacts
         uses: actions/upload-artifact@v2
         with:

build.gradle

@@ -74,12 +74,50 @@ jar {
     from sourceSets.api.output.resourcesDir
 }
 
-dependencies {
-    //to change the versions see the gradle.properties file
-    minecraft "com.mojang:minecraft:${project.minecraft_version}"
-    mappings "net.fabricmc:yarn:${project.yarn_mappings}:v2"
-    modImplementation "net.fabricmc:fabric-loader:${project.loader_version}"
+repositories {
+    // Log if any unknown repositories were added non-explicitly.
+    forEach { repo ->
+        if (repo.name == 'Fabric' || repo.name == 'Mojang' || repo.name == 'MavenRepo') {
+            // We know these exist already.
+            return
+        }
+        var url = repo.url as URI
+        var protocol = url.getScheme()
+        if (protocol == "file") {
+            // Local repositories are most likely safe.
+            return
+        }
+        println("[Sodium] Unknown repository \"${repo.name}\" with URL \"${url}\"")
+    }
+    Mojang {
+        content {
+            includeGroup('com.mojang')
+        }
+    }
+    Fabric {
+        content {
+            includeGroup('net.fabricmc.fabric-api')
+            includeGroup('net.fabricmc.unpick')
+            includeGroup('net.fabricmc')
+        }
+    }
+    // Most dependencies should be downloaded from maven central since they have the most strict security policy and most dependencies are just mirrored from maven central.
+    MavenRepo {
+        content {
+            // OW2 ASM is an exception which we download directly from their maven server which is signed with their PGP key.
+            excludeGroup('org.ow2.asm')
+        }
+    }
+    maven {
+        name 'ObjectWeb'
+        url 'https://repository.ow2.org/nexus/content/repositories/releases'
+        content {
+            includeGroup('org.ow2.asm')
+        }
+    }
+}
 
+dependencies {
     // Fabric API
     modIncludeImplementation(fabricApi.module("fabric-api-base", project.fabric_version))
     modIncludeImplementation(fabricApi.module("fabric-block-view-api-v2", project.fabric_version))

gradle.properties

@@ -1,6 +1,16 @@
 # Done to increase the memory available to gradle.
 org.gradle.jvmargs=-Xmx2G
 
+# Prevent gradle from auto downloading another JDK.
+org.gradle.java.installations.auto-download=false
+
+# Use lenient dependency verification by default for development purposes,
+#  porting to newer game versions can be harder without this.
+org.gradle.dependency.verification=lenient
+
+# Loom Properties
+systemProp.loom.test.reproducible=true
+
 # Fabric Properties
 # check these on https://fabricmc.net/develop/
 minecraft_version=1.20.2

gradle/.gitignore

@@ -0,0 +1,2 @@
+# Do not commit the binary pgp keyring.
+verification-keyring.gpg

scripts/update_verification_metadata.bat

@@ -0,0 +1,10 @@
+@echo off
+if not exist gradlew.bat (
+    echo Not running in the base project directory.
+    exit /b 1
+)
+
+gradlew.bat --refresh-dependencies --write-verification-metadata sha256 clean build && gradlew.bat --refresh-dependencies --write-verification-metadata pgp,sha256 --export-keys clean build
+
+del %~dp0gradle\verification-keyring.gpg
+echo Done.

scripts/update_verification_metadata.sh

@@ -0,0 +1,9 @@
+if [ ! -e gradlew ]; then
+    echo "Not running in the base project directory."
+    exit 1
+fi
+
+./gradlew --refresh-dependencies --write-verification-metadata sha256 clean build && ./gradlew --refresh-dependencies --write-verification-metadata pgp,sha256 --export-keys clean build
+
+rm gradle/verification-keyring.gpg
+echo "Done."

settings.gradle

@@ -1,10 +1,27 @@
 pluginManagement {
     repositories {
         maven {
-            name = 'Fabric'
-            url = 'https://maven.fabricmc.net/'
+            name 'ObjectWeb'
+            url 'https://repository.ow2.org/nexus/content/repositories/releases'
+            content {
+                includeGroup('org.ow2.asm')
+            }
         }
-        mavenCentral() // backup mirror for JCenter's Bintray, which is ordinarily used to resolve Eclipse's JGit
-        gradlePluginPortal()
+        maven {
+            name 'Fabric'
+            url 'https://maven.fabricmc.net'
+            content {
+                includeModule('fabric-loom', 'fabric-loom.gradle.plugin')
+                includeGroup('net.fabricmc.unpick')
+                includeGroup('net.fabricmc')
+            }
+        }
+        gradlePluginPortal {
+            content {
+                includeModule('io.github.juuxel.loom-vineflower', 'io.github.juuxel.loom-vineflower.gradle.plugin')
+                includeModule('io.github.juuxel', 'loom-vineflower')
+            }
+        }
+        mavenCentral()
     }
 }