Supply Chain
Does Gradle have a default repository like Maven Central?
No. Gradle has no default repository, so a migrated build must declare each one. Review repositories, mirrors and the local Maven cache after moving.
Oct 19, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
How do you stop Gradle fetching internal groups from public repos?
Use exclusiveContent in Gradle so internal groups resolve only from your private repository. It blocks lookups that leak names and swapped packages.
Oct 19, 20264 min read
Supply Chain
Does Gradle dependency verification still help behind a mirror?
Dependency verification checks downloads against recorded checksums, whichever repository serves them. What it proves, what bootstrapping trusts.
Oct 19, 20264 min read
Supply Chain
What does Gradle dependency verification check for Android SDKs?
Gradle dependency verification compares checksums and signatures against a committed file. What it catches, how to bootstrap it and where review still matters.
Oct 19, 20263 min read
Supply Chain
What is Gradle dependency verification, and does it find vulnerabilities?
Gradle dependency verification checks checksums and signatures to catch tampered artifacts, not vulnerable ones. What it covers and how to adopt it.
Oct 19, 20264 min read
Supply Chain
Can a Gradle included build silently replace a published dependency?
Yes. Gradle swaps an external dependency for an included build with matching group and name. Learn the risk and how to keep substitutions deliberate.
Oct 19, 20263 min read
Supply Chain
What happens when a golden path template ships old dependencies?
Stale defaults in a template spread to every new service. Learn how template dependency rot happens and a schedule that keeps defaults current.
Oct 19, 20264 min read
Supply Chain
Should a golden path template ship a committed lockfile?
Yes: a golden path template should commit a lockfile and make CI install from it. Here is how npm, Gradle and pip each enforce exact dependency versions.
Oct 19, 20264 min read
Supply Chain
What does a Godot game depend on? Export templates, addons and NuGet
A Godot project has more inputs than its scripts: export templates, addons, and NuGet packages for C#. A short inventory guide for small studios.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.