gradle/gradle · warning

Dependency verification has been disabled.

Error message

Dependency verification has been disabled.

What it means

ExternalModuleComponentResolverFactory wraps each module repository in dependency-verification machinery when verification is enabled. If the build carries verification configuration but the dependencyVerificationEnabled flag is false for this invocation (e.g. verification switched off via the org.gradle.dependency.verification Gradle property), this warning is logged and the repository chain is returned unwrapped: artifacts are resolved WITHOUT checksum or signature verification.

Source

Thrown at platforms/software/dependency-management/src/main/java/org/gradle/api/internal/artifacts/ivyservice/ivyresolve/ExternalModuleComponentResolverFactory.java:209

    ) {
        Action<? super ArtifactResolutionDetails> filter = Actions.doNothing();
        if (repository instanceof ContentFilteringRepository) {
            filter = ((ContentFilteringRepository) repository).getContentFilter();
        }

        if (filter == Actions.doNothing()) {
            return moduleComponentRepository;
        }

        return new FilteredModuleComponentRepository(moduleComponentRepository, filter);
    }

    private ModuleComponentRepository<ExternalModuleComponentGraphResolveState> maybeApplyDependencyVerification(
        ModuleComponentRepository<ExternalModuleComponentGraphResolveState> moduleComponentRepository,
        boolean dependencyVerificationEnabled
    ) {
        if (!dependencyVerificationEnabled) {
            LOGGER.warn("Dependency verification has been disabled.");
            return moduleComponentRepository;
        }

        return dependencyVerificationOverride.overrideDependencyVerification(moduleComponentRepository);
    }

    public ArtifactResult verifiedArtifact(DefaultResolvedArtifactResult defaultResolvedArtifactResult) {
        return dependencyVerificationOverride.verifiedArtifact(defaultResolvedArtifactResult);
    }

    /**
     * Provides access to the top-level resolver chain for looking up parent modules when parsing module descriptor files.
     */
    private static class ParentModuleLookupResolver implements ComponentResolvers, DependencyToComponentIdResolver, ComponentMetaDataResolver, ArtifactResolver {
        private final UserResolverChain delegate;

        public ParentModuleLookupResolver(
            VersionComparator versionComparator,

View on GitHub (pinned to 534f27719b)

Solutions

1. Remove org.gradle.dependency.verification=off from the command line and gradle.properties so verification runs again
2. If verification failures forced the flag, fix the root cause: audit and regenerate verification-metadata.xml with --write-verification-metadata
3. Treat any remaining 'off' as a tracked, expiring change; restore verification promptly
4. Audit the dependency cache afterwards: builds run without verification may have accepted unverified artifacts

Example fix

# before
./gradlew build -Porg.gradle.dependency.verification=off
# after
./gradlew build   # gradle/verification-metadata.xml governs artifact verification again

# Fail CI if dependency verification is switched off anywhere
if grep -rq 'org.gradle.dependency.verification=off' gradle.properties .github/workflows ci/ 2>/dev/null; then
  echo 'dependency verification is disabled somewhere; remove the override'
  exit 1
fi

When it happens

Trigger: A build that has gradle/verification-metadata.xml (or otherwise configures verification) is run with dependency verification disabled: -Porg.gradle.dependency.verification=off on the command line or the same key in gradle.properties, so maybeApplyDependencyVerification receives dependencyVerificationEnabled == false.

Common situations: A leftover org.gradle.dependency.verification=off committed to gradle.properties during an incident; CI jobs disabling verification while seeding caches; local developer overrides; test harnesses that disable verification globally.

Related errors

• Dependency verification cannot be performed
• Unable to read dependency verification metadata from %s
• {verification report summary} Open this report for more det
• You chose to generate {} checksums but they are all consider
• Expected a signature list in {}, but got {}. Skipping this s

AI-assisted analysis of gradle/gradle@534f27719b (2026-08-22). Data as JSON: /api/errors/0df28ef164f25a65. Report an issue: GitHub.