gradle/gradle · warning

You chose to generate {} checksums but they are all consider

Error message

You chose to generate {} checksums but they are all considered insecure. You should consider adding at least one of {}.

What it means

After --write-verification-metadata, Gradle checks whether at least one requested checksum kind is considered secure (sha256 or sha512). If none of the chosen kinds is in SECURE_CHECKSUMS (classic case: sha1 only), this warning recommends the secure alternatives, because insecure checksums are collision-broken and give weak supply-chain protection.

Source

Thrown at platforms/software/dependency-management/src/main/java/org/gradle/api/internal/artifacts/ivyservice/ivyresolve/verification/writer/WriteDependencyVerificationFile.java:172

        for (String checksum : checksums) {
            if (!SUPPORTED_CHECKSUMS.contains(checksum)) {
                // we cannot throw an exception at this stage because this happens too early
                // in the build and the user feedback isn't great ("cannot create service blah!")
                LOGGER.warn("Invalid checksum type: '" + checksum + "'. You must choose one or more in " + SUPPORTED_CHECKSUMS);
            }
        }
        assertPgpHasChecksumFallback(checksums);
    }

    private void assertPgpHasChecksumFallback(List<String> kinds) {
        if (kinds.size() == 1 && PGP.equals(kinds.get(0))) {
            throw new DependencyVerificationException("Generating a file with signature verification requires at least one checksum type (sha256 or sha512) as fallback.");
        }
    }

    private void warnAboutInsecureChecksums() {
        if (checksums.stream().noneMatch(SECURE_CHECKSUMS::contains)) {
            LOGGER.warn("You chose to generate " + String.join(" and ", checksums) + " checksums but they are all considered insecure. You should consider adding at least one of " + String.join(" or ", SECURE_CHECKSUMS) + ".");
        }
    }

    @Override
    public ModuleComponentRepository<ExternalModuleComponentGraphResolveState> overrideDependencyVerification(ModuleComponentRepository<ExternalModuleComponentGraphResolveState> original) {
        return new DependencyVerifyingModuleComponentRepository(original, this, generatePgpInfo);
    }

    private void maybeCleanupDryRunFiles() {
        if (isDryRun) {
            boolean removed = false;
            removed |= mayBeDryRunFile(verificationFile).delete() || removed;
            if (isExportKeyring) {
                BuildTreeDefinedKeys existingKeyring = new BuildTreeDefinedKeys(verificationFile.getParentFile(), verificationsBuilder.getKeyringFormat());
                removed |= mayBeDryRunFile(existingKeyring.getAsciiKeyringsFile()).delete();
                removed |= mayBeDryRunFile(existingKeyring.getBinaryKeyringsFile()).delete();
            }
            if (removed) {

View on GitHub (pinned to 534f27719b)

Solutions

1. Regenerate including a secure kind: --write-verification-metadata sha256,sha512 (a legacy kind may be kept alongside)
2. Rotate any verification-metadata.xml that contains only insecure hashes: regenerate and review it
3. Add a CI check that generated metadata must contain sha256 or sha512 entries

Example fix

# before
./gradlew build --write-verification-metadata sha1
# after
./gradlew build --write-verification-metadata sha256,sha512

# Require at least one secure kind
echo "$CHECKSUMS" | grep -qE 'sha256|sha512' || { echo 'no secure checksum kind requested (need sha256 or sha512)'; exit 1; }

When it happens

Trigger: --write-verification-metadata is invoked with a kind set containing no sha256/sha512 (e.g. sha1 only); checksums.stream().noneMatch(SECURE_CHECKSUMS::contains) is true, so the build warns and names sha256/sha512 as the kinds to add.

Common situations: Teams keeping sha1 for compatibility with old consumers; generation scripts defaulting to legacy hashes; policy exceptions that were never revisited.

Related errors

• Dependency verification cannot be performed
• {verification report summary} Open this report for more det
• Dependency verification has been disabled.
• Invalid checksum type: '{}'. You must choose one or more in
• Cannot compute checksum for {} because it doesn't exist. It

AI-assisted analysis of gradle/gradle@534f27719b (2026-08-22). Data as JSON: /api/errors/74ce349ffc77779c. Report an issue: GitHub.