title: Verification of dependency authenticity in Maven POM based automated build systems
body: <p>I was just pointed to a very interesting <a href="http://www.fortify.com/servlet/downloads/public/fortify_attacking_the_build.pdf" rel="nofollow noreferrer">article</a> (<a href="https://web.archive.org/web/20160310192751/https://www.fortify.com/downloads2/public/fortify_attacking_the_build.pdf" rel="nofollow noreferrer">archived</a>) about a security problem called
  Cross Build Injection (XBI). Bascially it is a fancy name for smuggling bad code
  into an application at build time via automated build systems such as ant, maven or ivy.</p>
  <p>The problem could be alleviated by introducing a cryptographic signature validation für dependencies as it is currently in place with many operating systems for downloading packages.</p>
  <p>To be clear: I am <em>not</em> talking about simply providing md5 or sha1 hashes for the artifacts. That is already done, but those hashes are stored in the same location as the artifacts. So once a malicious hacker compromises the repository and can replace the artifact they can replace the hashes as well.</p>
  <p>So what is acutally needed is some kind of PKI, that allows the developers to sign their artifacts and maven to verify these signatures. Since the signature is done using the private key of the developer it cannot be tampered with when only the repository is compromised.</p>
  <p>Does anyone know the state of this in maven?</p>