Dependency verification failed for configuration ':classpath'

[dabitdev]

I just cloned the project in android studio 4.0.1 and I got this error.
Do you have a gradle/verification-metadata.xml to be used to by pass failed verification?

Dependency verification failed for configuration ':classpath'
56 artifacts failed verification:
  - aapt2-proto-4.0.1-6197926.jar (com.android.tools.build:aapt2-proto:4.0.1-6197926) from repository Google
  - aapt2-proto-4.0.1-6197926.pom (com.android.tools.build:aapt2-proto:4.0.1-6197926) from repository Google
  - aaptcompiler-4.0.1.jar (com.android.tools.build:aaptcompiler:4.0.1) from repository Google
  - aaptcompiler-4.0.1.pom (com.android.tools.build:aaptcompiler:4.0.1) from repository Google
  - annotations-27.0.1.jar (com.android.tools:annotations:27.0.1) from repository Google
  - annotations-27.0.1.pom (com.android.tools:annotations:27.0.1) from repository Google
  - apksig-4.0.1.jar (com.android.tools.build:apksig:4.0.1) from repository Google
  - apksig-4.0.1.pom (com.android.tools.build:apksig:4.0.1) from repository Google
  - apkzlib-4.0.1.jar (com.android.tools.build:apkzlib:4.0.1) from repository Google
  - apkzlib-4.0.1.pom (com.android.tools.build:apkzlib:4.0.1) from repository Google
  - baseLibrary-4.0.1.jar (com.android.databinding:baseLibrary:4.0.1) from repository Google
  - baseLibrary-4.0.1.pom (com.android.databinding:baseLibrary:4.0.1) from repository Google
  - builder-4.0.1.jar (com.android.tools.build:builder:4.0.1) from repository Google
  - builder-4.0.1.pom (com.android.tools.build:builder:4.0.1) from repository Google
  - builder-model-4.0.1.jar (com.android.tools.build:builder-model:4.0.1) from repository Google
  - builder-model-4.0.1.pom (com.android.tools.build:builder-model:4.0.1) from repository Google
  - builder-test-api-4.0.1.jar (com.android.tools.build:builder-test-api:4.0.1) from repository Google
  - builder-test-api-4.0.1.pom (com.android.tools.build:builder-test-api:4.0.1) from repository Google
  - common-27.0.1.jar (com.android.tools:common:27.0.1) from repository Google
  - common-27.0.1.pom (com.android.tools:common:27.0.1) from repository Google
  - crash-27.0.1.jar (com.android.tools.analytics-library:crash:27.0.1) from repository Google
  - crash-27.0.1.pom (com.android.tools.analytics-library:crash:27.0.1) from repository Google
  - databinding-common-4.0.1.jar (androidx.databinding:databinding-common:4.0.1) from repository Google
  - databinding-common-4.0.1.pom (androidx.databinding:databinding-common:4.0.1) from repository Google
  - databinding-compiler-common-4.0.1.jar (androidx.databinding:databinding-compiler-common:4.0.1) from repository Google
  - databinding-compiler-common-4.0.1.pom (androidx.databinding:databinding-compiler-common:4.0.1) from repository Google
  - ddmlib-27.0.1.jar (com.android.tools.ddms:ddmlib:27.0.1) from repository Google
  - ddmlib-27.0.1.pom (com.android.tools.ddms:ddmlib:27.0.1) from repository Google
  - dvlib-27.0.1.jar (com.android.tools:dvlib:27.0.1) from repository Google
  - dvlib-27.0.1.pom (com.android.tools:dvlib:27.0.1) from repository Google
  - gradle-4.0.1.jar (com.android.tools.build:gradle:4.0.1) from repository Google
  - gradle-4.0.1.pom (com.android.tools.build:gradle:4.0.1) from repository Google
  - gradle-api-4.0.1.jar (com.android.tools.build:gradle-api:4.0.1) from repository Google
  - gradle-api-4.0.1.pom (com.android.tools.build:gradle-api:4.0.1) from repository Google
  - layoutlib-api-27.0.1.jar (com.android.tools.layoutlib:layoutlib-api:27.0.1) from repository Google
  - layoutlib-api-27.0.1.pom (com.android.tools.layoutlib:layoutlib-api:27.0.1) from repository Google
  - lint-gradle-api-27.0.1.jar (com.android.tools.lint:lint-gradle-api:27.0.1) from repository Google
  - lint-gradle-api-27.0.1.pom (com.android.tools.lint:lint-gradle-api:27.0.1) from repository Google
  - manifest-merger-27.0.1.jar (com.android.tools.build:manifest-merger:27.0.1) from repository Google
  - manifest-merger-27.0.1.pom (com.android.tools.build:manifest-merger:27.0.1) from repository Google
  - protos-27.0.1.jar (com.android.tools.analytics-library:protos:27.0.1) from repository Google
  - protos-27.0.1.pom (com.android.tools.analytics-library:protos:27.0.1) from repository Google
  - repository-27.0.1.jar (com.android.tools:repository:27.0.1) from repository Google
  - repository-27.0.1.pom (com.android.tools:repository:27.0.1) from repository Google
  - sdk-common-27.0.1.jar (com.android.tools:sdk-common:27.0.1) from repository Google
  - sdk-common-27.0.1.pom (com.android.tools:sdk-common:27.0.1) from repository Google
  - sdklib-27.0.1.jar (com.android.tools:sdklib:27.0.1) from repository Google
  - sdklib-27.0.1.pom (com.android.tools:sdklib:27.0.1) from repository Google
  - shared-27.0.1.jar (com.android.tools.analytics-library:shared:27.0.1) from repository Google
  - shared-27.0.1.pom (com.android.tools.analytics-library:shared:27.0.1) from repository Google
  - signflinger-4.0.1.jar (com.android:signflinger:4.0.1) from repository Google
  - signflinger-4.0.1.pom (com.android:signflinger:4.0.1) from repository Google
  - tracker-27.0.1.jar (com.android.tools.analytics-library:tracker:27.0.1) from repository Google
  - tracker-27.0.1.pom (com.android.tools.analytics-library:tracker:27.0.1) from repository Google
  - zipflinger-4.0.1.jar (com.android:zipflinger:4.0.1) from repository Google
  - zipflinger-4.0.1.pom (com.android:zipflinger:4.0.1) from repository Google
If the artifacts are trustworthy, you will need to update the gradle/verification-metadata.xml file by following the instructions at https://docs.gradle.org/6.5/userguide/dependency_verification.html#sec:troubleshooting-verification

Open this report for more details: file:///Users/dabitdev/Projects/breadwallet-android/build/reports/dependency-verification/at-1597166912388/dependency-verification-report.html

[dabitdev]

nevermind, I will try this

<?xml version="1.0" encoding="UTF-8"?>
<verification-metadata>
   <configuration>
      <verify-metadata>false</verify-metadata>
      <verify-signatures>false</verify-signatures>
    </configuration>
    <!-- the rest of this file doesn't need to declare anything about metadata files -->
</verification-metadata>

[dabitdev]

well, I had to rewrite the metadata using the following command.

./gradlew --write-verification-metadata sha256 help

It means that is not updated in the repo. @DrewCarlson you might want to push a new verification metadata.

[DrewCarlson]

This is a somewhat common issue and isn't actually a fault of outdated verification metadata. It usually helps to remove your ~/.gradle directory then perform a build, make sure to reset your verification metadata changes first.

[dabitdev]

This is not a great experience for new devs. Should the ./gradle folder be removed from the repo.

[DrewCarlson]

Agreed, we sometimes experience it internally after Android Studio updates. It's an ongoing issue with Android Studio that we are still trying to resolve.

You can see more information in the HTML file that is linked after a metadata error. It usually explains that the dependency cache is tampered with, clearing the cache is the best way to resolve such an error.

[dabitdev]

got it, I removed my gradle/verification-metadata.xml from my pull request.