// Copyright (C) 2025 Gradle, Inc.
//
// Licensed under the Creative Commons Attribution-Noncommercial-ShareAlike 4.0 International License.;
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//      https://creativecommons.org/licenses/by-nc-sa/4.0/
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

[[best_practices_for_security]]
= Best Practices for Security

[[validate_gradle_checksum]]
== Validate the Gradle Distribution SHA-256 Checksum

Set `distributionSha256Sum` in `gradle-wrapper.properties` to verify the integrity of the downloaded Gradle distribution.

=== Explanation

Always set the `distributionSha256Sum` property in your `gradle-wrapper.properties` file to verify the integrity of the downloaded Gradle distribution.
This ensures the `gradle-X.X-bin.zip` file matches the official SHA-256 checksum published by Gradle, protecting your build from corruption or tampering.

[source,properties]
----
distributionUrl=https\://services.gradle.org/distributions/gradle-8.6-bin.zip
distributionSha256Sum=2b3f4...sha256-here...f4511
----

This validation step enhances security by preventing the execution of compromised or incomplete Gradle distributions.

The official SHA-256 checksums can be found on the link:https://gradle.org/releases/[Gradle releases page].

=== References

- link:https://gradle.org/releases/[Gradle Releases with Checksums]
- <<gradle_wrapper.adoc#gradle_wrapper,Gradle Wrapper Reference>>

=== Tags

<<tags_reference.adoc#tag:properties,`#properties`>>, <<tags_reference.adoc#tag:wrapper,`#wrapper`>>

[[validate_wrapper_checksum]]
== Validate the Gradle Wrapper on every Upgrade

The Gradle Wrapper runs before your build logic and can deeply affect your build.
You should treat any change to the Wrapper as security-sensitive.

Validate the Wrapper JAR and distribution settings every time you upgrade Gradle.

=== Explanation

When you update Gradle, two Wrapper files typically change:

- `gradle/wrapper/gradle-wrapper.jar`
- `gradle/wrapper/gradle-wrapper.properties` (`distributionUrl` and optionally `distributionSha256Sum`)

You should verify that:

- The **Wrapper JAR** is the official binary published by Gradle (not tampered with).
- The **Wrapper JAR checksum** matches one of the values published at link:https://gradle.org/release-checksums[gradle.org/release-checksums].
- The **distribution URL** points to the expected Gradle release.
- The **distribution checksum** (if configured via `distributionSha256Sum`) matches the release you intend to use (also listed on link:https://gradle.org/release-checksums[gradle.org/release-checksums]).

Running an unverified Wrapper risks executing untrusted code before any of your build’s safeguards run.

==== Do this

If you use the link:https://github.com/marketplace/actions/build-with-gradle#the-setup-gradle-action[`setup-gradle` action] (version v4 or newer) for link:https://github.com/features/actions[GitHub Actions], Wrapper validation will be performed automatically.
The action validates the checksum of every `gradle-wrapper.jar` in your repository and fails the build if it finds any unknown Wrapper JAR.

If you use a different GitHub Actions setup, you can use the dedicated link:https://github.com/marketplace/actions/build-with-gradle#the-wrapper-validation-action[Gradle Wrapper validation action] instead.

=== References

- <</gradle_wrapper.adoc#configuring_checksum_verification,Gradle Wrapper checksum verification>>
- link:https://gradle.org/release-checksums[Gradle release checksums]

=== Tags

`<<tags_reference.adoc#tag:wrapper,#wrapper>>`

[[run_gradle_on_external_projects]]
== Do not Run `./gradlew` on Untrusted Projects

When working with an untrusted project, you should exercise caution before running `./gradlew`.

=== Explanation

The `gradlew` (Gradle Wrapper) script is an executable that downloads and runs a specific version of Gradle.
It _should_ be generated by running the <<gradle_wrapper.adoc#sec:adding_wrapper,Wrapper task>> with a trusted Gradle installation, but there is no guarantee that a project's authors have done this.
The script or `gradle-wrapper.jar` could have been modified.
The only way to verify this is through <<validate_wrapper_checksum,checksum verification>>.

Running an unverified wrapper is similar to running any other untrusted script from the internet.
Build scripts (`build.gradle`, `settings.gradle`, etc.) can also execute arbitrary code during the configuration phase.

An unreviewed wrapper or build script could potentially access or modify files on your system, install malicious software, or compromise your environment (e.g., stealing environment variables like `GITHUB_TOKEN` or `AWS_SECRET_KEY`).

NOTE: Opening an untrusted project in an IDE such as IntelliJ IDEA or Android Studio will typically trigger a Gradle sync automatically, which executes build logic.
Review the project's wrapper and build scripts _before_ opening it in your IDE.

==== Do this

===== 1. Review the Build Scripts

* **Inspect Build Files:** Look at `build.gradle(.kts)`, `settings.gradle(.kts)`, and `gradle.properties` for suspicious dependencies, plugins, custom `exec` tasks, or obfuscated code.

===== 2. Verify the Gradle Wrapper Files

* **Checksum Verification:** Use <<validate_wrapper_checksum,checksum validation>> to ensure `gradle-wrapper.jar` hasn't been tampered with.
* **Check the URL:** Open `gradle/wrapper/gradle-wrapper.properties` and ensure the `distributionUrl` points strictly to the official site: `https://services.gradle.org/`.
* **Regenerate the Wrapper:** If you have a trusted Gradle installation, delete the project's `gradlew`, `gradlew.bat`, and `gradle/wrapper/gradle-wrapper.jar`, then run `gradle wrapper` (not `./gradlew`).
Compare the regenerated files against the originals, any differences indicate the project's wrapper may have been modified.

===== 3. Work in an Isolated Environment

You can optionally run the project in a **Docker container** or a **Virtual Machine (VM)**.
This ensures that even if a malicious script runs, it cannot access your files.

=== References

- <<gradle_wrapper.adoc#gradle_wrapper,Gradle Wrapper Reference>>

=== Tags

`<<tags_reference.adoc#tag:wrapper,#wrapper>>`
