Developer Tools
Are Gradle jar and zip files reproducible by default?
From Gradle 9.0.0 archive tasks are reproducible by default: fixed order, timestamps and permissions. On older versions you set three properties yourself.
Oct 19, 20264 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedDeveloper Tools
Gradle platform or Maven BOM: how do you share dependency versions?
Both a Gradle platform and a Maven BOM keep versions consistent across modules. How each works, how they interoperate, and how to use them for patches.
Oct 19, 20263 min read
Developer Tools
How do I replace an abandoned library everywhere in a Gradle build?
Gradle module replacement tells the resolver to use one module wherever another is requested, even transitively. When it fits a security fix and its risks.
Oct 19, 20264 min read
Developer Tools
How do you upgrade a Gradle build to a new major version safely?
Before a Gradle major upgrade, run the latest minor, read deprecation warnings and update plugins. Here are the steps and what to check in each.
Oct 19, 20263 min read
Developer Tools
Gradle dynamic versions: how to lock them without losing updates
Gradle dynamic versions like 1.+ can change what you build. Dependency locking records the resolved result so builds stay stable until you update.
Oct 19, 20264 min read
Developer Tools
Gradle dependency locking: when do you need it?
Dependency locking pins the exact versions Gradle resolved so builds stay repeatable. Learn how to enable it, what it skips by default, and how it differs.
Oct 19, 20264 min read
Developer Tools
What should the because clause say on a Gradle dependency constraint?
The Gradle because clause records why a constraint exists. Write the advisory, owner, and review date so the next team does not delete it blindly.
Oct 19, 20263 min read
Developer Tools
How do you centralize Gradle repositories and block project ones?
Declare repositories once in settings.gradle and set FAIL_ON_PROJECT_REPOS so no subproject or plugin can quietly add another download source.
Oct 19, 20264 min read
Developer Tools
govulncheck has no ignore list: how do you track accepted findings?
govulncheck cannot silence a finding. Keep accepted Go vulnerabilities in a separate, dated exceptions file and compare it with the JSON or OpenVEX output.
Oct 19, 20264 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.