{"record":{"id":"74ce349ffc77779c","repo":"gradle/gradle","slug":"you-chose-to-generate-checksums-but-they-are-al","errorCode":null,"errorMessage":"You chose to generate {} checksums but they are all considered insecure. You should consider adding at least one of {}.","messagePattern":"You chose to generate (.+?) checksums but they are all considered insecure\\. You should consider adding at least one of (.+?)\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"platforms/software/dependency-management/src/main/java/org/gradle/api/internal/artifacts/ivyservice/ivyresolve/verification/writer/WriteDependencyVerificationFile.java","lineNumber":172,"sourceCode":"        for (String checksum : checksums) {\n            if (!SUPPORTED_CHECKSUMS.contains(checksum)) {\n                // we cannot throw an exception at this stage because this happens too early\n                // in the build and the user feedback isn't great (\"cannot create service blah!\")\n                LOGGER.warn(\"Invalid checksum type: '\" + checksum + \"'. You must choose one or more in \" + SUPPORTED_CHECKSUMS);\n            }\n        }\n        assertPgpHasChecksumFallback(checksums);\n    }\n\n    private void assertPgpHasChecksumFallback(List<String> kinds) {\n        if (kinds.size() == 1 && PGP.equals(kinds.get(0))) {\n            throw new DependencyVerificationException(\"Generating a file with signature verification requires at least one checksum type (sha256 or sha512) as fallback.\");\n        }\n    }\n\n    private void warnAboutInsecureChecksums() {\n        if (checksums.stream().noneMatch(SECURE_CHECKSUMS::contains)) {\n            LOGGER.warn(\"You chose to generate \" + String.join(\" and \", checksums) + \" checksums but they are all considered insecure. You should consider adding at least one of \" + String.join(\" or \", SECURE_CHECKSUMS) + \".\");\n        }\n    }\n\n    @Override\n    public ModuleComponentRepository<ExternalModuleComponentGraphResolveState> overrideDependencyVerification(ModuleComponentRepository<ExternalModuleComponentGraphResolveState> original) {\n        return new DependencyVerifyingModuleComponentRepository(original, this, generatePgpInfo);\n    }\n\n    private void maybeCleanupDryRunFiles() {\n        if (isDryRun) {\n            boolean removed = false;\n            removed |= mayBeDryRunFile(verificationFile).delete() || removed;\n            if (isExportKeyring) {\n                BuildTreeDefinedKeys existingKeyring = new BuildTreeDefinedKeys(verificationFile.getParentFile(), verificationsBuilder.getKeyringFormat());\n                removed |= mayBeDryRunFile(existingKeyring.getAsciiKeyringsFile()).delete();\n                removed |= mayBeDryRunFile(existingKeyring.getBinaryKeyringsFile()).delete();\n            }\n            if (removed) {","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/gradle/gradle/blob/534f27719b66953f95cc907aae7f2c1b12f5482d/platforms/software/dependency-management/src/main/java/org/gradle/api/internal/artifacts/ivyservice/ivyresolve/verification/writer/WriteDependencyVerificationFile.java#L154-L190","documentation":"After --write-verification-metadata, Gradle checks whether at least one requested checksum kind is considered secure (sha256 or sha512). If none of the chosen kinds is in SECURE_CHECKSUMS (classic case: sha1 only), this warning recommends the secure alternatives, because insecure checksums are collision-broken and give weak supply-chain protection.","triggerScenarios":"--write-verification-metadata is invoked with a kind set containing no sha256/sha512 (e.g. sha1 only); checksums.stream().noneMatch(SECURE_CHECKSUMS::contains) is true, so the build warns and names sha256/sha512 as the kinds to add.","commonSituations":"Teams keeping sha1 for compatibility with old consumers; generation scripts defaulting to legacy hashes; policy exceptions that were never revisited.","solutions":["Regenerate including a secure kind: --write-verification-metadata sha256,sha512 (a legacy kind may be kept alongside)","Rotate any verification-metadata.xml that contains only insecure hashes: regenerate and review it","Add a CI check that generated metadata must contain sha256 or sha512 entries"],"exampleFix":"# before\n./gradlew build --write-verification-metadata sha1\n# after\n./gradlew build --write-verification-metadata sha256,sha512","handlingStrategy":"validation","validationCode":"# Require at least one secure kind\necho \"$CHECKSUMS\" | grep -qE 'sha256|sha512' || { echo 'no secure checksum kind requested (need sha256 or sha512)'; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default generation scripts to sha256,sha512","Add a CI lint that verification-metadata.xml contains sha256/sha512 entries","Treat sha1-only metadata as tech debt with an expiry date"],"tags":["gradle","dependency-verification","checksum","sha1","supply-chain"],"backgroundTag":"insecure-checksum-algorithm","analyzedSha":"534f27719b66953f95cc907aae7f2c1b12f5482d","analyzedAt":"2026-08-22T08:09:12.375Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}