RUST-137 Add gradle/verification-metadata.xml for dependency verification by saberduck · Pull Request #226 · SonarSource/sonar-rust

saberduck · 2026-04-27T09:37:18Z

Adds SHA-256 checksums for all resolved Gradle dependencies
Provides supply-chain integrity guarantees (artifacts verified against known checksums on each build)
Signatures verification (verify-signatures) left as false (checksums only, standard first-step setup)

Records SHA-256 checksums for all resolved dependencies, providing supply-chain guarantees. Also satisfies SonarQube rule S8569 which requires either gradle.lockfile or gradle/verification-metadata.xml next to each build.gradle.kts.

hashicorp-vault-sonar-prod · 2026-04-27T09:37:39Z

RUST-137

sonar-review-alpha · 2026-04-27T09:38:06Z

Summary

This PR adds Gradle dependency verification via gradle/verification-metadata.xml, containing SHA-256 checksums for all resolved dependencies. This implements supply-chain integrity checks for the build without requiring signed artifacts.

The PR also updates the build configuration to use SonarSource's Artifactory repository (repox.jfrog.io) for plugin resolution, and adds the SonarSource/ci-github-actions/config-gradle@v1 action to CI workflows to configure Gradle credentials at build time. These supporting changes enable the verification metadata to be used effectively in CI/CD.

Signature verification is disabled (checksums only), as noted in the author's description—this represents a common first-step setup before progressing to full signature validation.

What reviewers should know

What to review:

gradle/verification-metadata.xml (~1200 lines) — This file contains the SHA-256 hashes for every dependency (JARs and POMs). Check that it's properly formatted and includes all expected components. The file is large but mechanically generated; spot-check a few entries to confirm hash formatting.
Artifactory configuration in settings.gradle.kts, buildSrc/build.gradle.kts, and e2e/build.gradle.kts — Ensures build scripts can reach the repox.jfrog.io repository. Credentials come from environment variables or Gradle properties; verify fallback handling looks safe.
CI workflow updates (.github/workflows/build.yml) — The SonarSource/ci-github-actions/config-gradle@v1 action is added before Gradle invocations to inject credentials. Verify it's placed correctly (before builds that need Artifactory access) and consistently across all jobs.

Key details for reviewers:

The verification metadata currently allows checksums only (verify-signatures: false). This is intentional per the author's note.
Artifactory is required because some dependencies (or plugins) are published to SonarSource's private repository, not Maven Central.
The metadata file references "Generated by Gradle," indicating it was generated locally—consider how this will be updated (manually regenerated periodically vs. automated CI task).
The PR supersedes #225 (gradle.lockfile approach) if merged.

Generate Walkthrough
Generate Diagram

🗣️ Give feedback

Add pluginManagement in settings.gradle.kts and update buildSrc and e2e to resolve through repox first, following the same pattern as sonar-skunk. This ensures verification-metadata.xml checksums match on CI where all artifacts are fetched through repox.

The cross_platform_analyzers CI job has no Artifactory credentials, so plugins can only be resolved via Gradle Plugin Portal when repox returns 401.

sonar-review-alpha

LGTM! ✅

🗣️ Give feedback

sonarqube-next · 2026-04-27T12:56:08Z

Quality Gate passed for 'sonar-rust'

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

romainbrenguier

That looks OK, but I think you need to verify the metadata and then change the "Generated by Gradle" to "Verified"

saberduck requested a review from a team as a code owner April 27, 2026 09:37

saberduck requested a review from romainbrenguier April 27, 2026 09:37

hashicorp-vault-sonar-prod Bot changed the title ~~Add gradle/verification-metadata.xml for dependency verification~~ RUST-137 Add gradle/verification-metadata.xml for dependency verification Apr 27, 2026