You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Make the addition of JitPack repository configurable (#48595)
Summary:
Pull Request resolved: #48595
Historically React Native used to include the JitPack repository be default in the default repositories.
This sadly exposes React Native projects to supply chain attacks as explained here:
https://blog.oversecured.com/Introducing-MavenGate-a-supply-chain-attack-method-for-Java-and-Android-applications/
Moreover, artifacts on Jitpack are not GPG signed it's complicated to verify the identity of artifact authors.
I'm introducing a Gradle property to control if Jitpack should be included by default or not.
User can control this behavior by changing their `gradle.properties` file as such:
```
includeJitpackRepository=false
```
The default value of this property is currently true, but we're looking into changing it to false in the future.
Changelog:
[Android] [Added] - Make the addition of JitPack repository configurable
Reviewed By: cipolleschi
Differential Revision: D68016028
fbshipit-source-id: 392513fef389a4835b4e00a8184459e00d51fdd0
Copy file name to clipboardExpand all lines: packages/gradle-plugin/react-native-gradle-plugin/src/main/kotlin/com/facebook/react/utils/DependencyUtils.kt
Copy file name to clipboardExpand all lines: packages/gradle-plugin/react-native-gradle-plugin/src/main/kotlin/com/facebook/react/utils/PropertyUtils.kt
Copy file name to clipboardExpand all lines: packages/gradle-plugin/react-native-gradle-plugin/src/test/kotlin/com/facebook/react/utils/DependencyUtilsTest.kt
0 commit comments