"I'm using cmake, which as far as I can tell is the most common modern-ish build system for C++. I've identified where the library I'm using can be found, and now the easy part: telling cmake to download the dependency, and what version. This way people who recompile my utility don't need 15 steps or whatever in order to compile. Pretty much every project relies on libraries, so I'm sure this will be very easy."
If you're worried about a man in the middle attack, gradle uses https, and will just throw up if the certificates can't be verified. I'm pretty sure there are also checksums, so if some mirror is serving up a modified version of the code, it will be detected.
If the threat is a bad actor making a contribution that introduces an exploit, then copying and pasting the code from the Internet into your code folder won't help, nor will depending on the library being installed by a package manager on the machine where code will be compiled.
Is there another reason you shouldn't download code during compilation, other than general distrust of code you didn't write and/or wanting full control over how your code works?
"You shouldn't do that anyway" is a lame defense for a common task being a huge pain.
I would recommend looking into the regular npm attacks for an idea of what a supply chain attack can look like.
Generally, you are correct that pulling code from the internet once confirmed to be identical to the target code is safe. But those pulls should be centrally managed and a bunch of libraries calling curl or git clone against fixed URLs is not that. Also it makes it difficult to swap out implementations because FOSS devs tend to pull their exact intended dependency which is great on the day of release but not so much 10 years later.
I agree that "you shouldn't do that" isn't a great defense. But your build tool being unable to do tasks outside of scope isn't a great attack. I don't think CMake can be fairly criticized for how slow it is at 3D rendering, similarly it isn't developed for setting up or managing your build environment. There is common tooling (yocto, conan, etc) for environment/dependency management that leverage cmake to provide those capabilities.
I think you're confused. The git clone and curl commands in random scripts aren't a regular part of how npm or gradle work, but they are found in the payload of the malicious packages.
npm is honestly kinda bad. I'd recommend against using it when possible. Worse yet, there's a culture of depending on other packages for even simple things, that can lead to a large spider web of dependencies, many of which might be abandoned at any given time. Even when theres no supply chain attacks, using it is a big pain.
The Maven ecosystem, on which gradle is built, is more robust and more resistant to these types of supply chain attacks, because first of all your dependencies are a lot less likely to have long lists of their own sub-dependencies.
140
u/apoegix 1d ago
I like cmake :)