# Insecure build dependency fetching

Build files and CI scripts fetching dependencies over http:// or without integrity/checksum verification

_Area: Software supply chain and CI/CD. Seen in 3 disclosed reports; 2 confirmed bounties: $100 and $280; latest 2026-01-07. Updated 2026-11-01._

## How it works
A build trusts whatever bytes arrive from a dependency source. That trust is only sound if the bytes are authenticated: fetched over TLS from a trusted host *and* pinned to an expected hash or signature. When a build fetches over plain HTTP, or fetches over any channel without verifying a hash, the assumption "the artifact I get is the artifact the author published" breaks. Anyone on the network path (or controlling the remote server) can substitute code that the build then compiles, tests and ships. The lockfile is supposed to be the integrity anchor; if a resolution path never records a hash, the lockfile proves nothing [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-7vhp-vf5g-r2fw.md).

## Where it shows up
- Build files declaring `resolvers http://` or `repositories http://` (SBT `plugins.sbt`, Maven `pom.xml`) [E2](https://bugbountylibrary.com/r/h1%3A505007.md)
- CI scripts using `wget`/`curl` with `http://` URLs for tarballs or zips [E3](https://bugbountylibrary.com/r/h1%3A1039504.md)
- Downloads followed by no checksum, signature or hash comparison [E3](https://bugbountylibrary.com/r/h1%3A1039504.md)
- Package-manager resolvers that return only a URL for raw-HTTP or git tarball deps, leaving the lockfile entry with no `integrity` field [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-7vhp-vf5g-r2fw.md)
- Shared artifact caches that persist fetched JARs across jobs and machines [E2](https://bugbountylibrary.com/r/h1%3A505007.md)

## How to review
The invariant: every dependency byte that reaches a build is authenticated before use — either by TLS to a pinned trusted origin *and* a recorded hash, or by an explicit checksum/signature check in the script.
- For each fetch, ask: is the scheme `https://`? Is there a hash/signature check after download? If either answer is no, it is unsafe.
- For lockfiles: confirm every entry, including alternate resolution paths (raw URL, git tarball), carries an integrity hash [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-7vhp-vf5g-r2fw.md).
- Trace which build/test jobs actually execute the fetched artifact, not just download it [E3](https://bugbountylibrary.com/r/h1%3A1039504.md).
- Check whether fetched artifacts land in a shared cache that outlives the job [E2](https://bugbountylibrary.com/r/h1%3A505007.md).

## How finders spotted it
- Read the tarball resolver source, saw it returned `{tarball: resolvedUrl}` with no integrity field, then checked the resulting lockfile entry and confirmed with a rotating-content server [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-7vhp-vf5g-r2fw.md).
- GitHub code search for `org:<target> resolvers http://` / `repositories http://`, then enumerated `plugins.sbt` and `pom.xml` hits [E2](https://bugbountylibrary.com/r/h1%3A505007.md).
- Reviewed CI config and `build-deps.sh`, noticed `wget` URLs used `http://` and no checksum followed, then traced which jobs run those functions [E3](https://bugbountylibrary.com/r/h1%3A1039504.md).

## Variants seen
- Package-manager lockfile integrity bypass via an alternate resolver path [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-7vhp-vf5g-r2fw.md)
- JVM build files resolving over HTTP, executed during build/test [E2](https://bugbountylibrary.com/r/h1%3A505007.md)
- CI shell script fetching third-party tarballs over HTTP with no verification [E3](https://bugbountylibrary.com/r/h1%3A1039504.md)

## Why fixes fail
Switching a URL to HTTPS alone does not restore integrity where the upstream host or resolver still serves unverified content; the hash must be recorded and checked [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-7vhp-vf5g-r2fw.md). Compromised JARs persist in shared caches and released artifacts, so cleaning the build file does not remove already-poisoned outputs [E2](https://bugbountylibrary.com/r/h1%3A505007.md).

## Impact and severity
Remote code execution during build/test, and malicious code shipped into released artifacts and downstream production [E2](https://bugbountylibrary.com/r/h1%3A505007.md)[E3](https://bugbountylibrary.com/r/h1%3A1039504.md). Severity rises with reach: shared caches and released artifacts keep downstream users infected after the fix [E2](https://bugbountylibrary.com/r/h1%3A505007.md), and per-request payload variation evades audits for persistent compromise [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-7vhp-vf5g-r2fw.md). Bounties ranged 100–280 (median 190).

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-7vhp-vf5g-r2fw.md
- E2: https://bugbountylibrary.com/r/h1%3A505007.md
- E3: https://bugbountylibrary.com/r/h1%3A1039504.md