Renovate opens the PR, Gradle's checksum verification fails the build

A dev.to post titled "Solving Gradle metadata and Renovate integration" describes adding Renovate to a Gradle project and then finding that merges of new dependency versions failed the build ^[1][2][4]. The two ingredients are ones plenty of teams adopt independently and never test together: a bot that opens dependency-bump PRs, and integrity verification that pins exactly which bytes the build is allowed to consume ^[3][9].

Renovate, in the author's description, works like Dependabot: it checks for new versions of your dependencies and creates PRs for you automatically ^[3]. The verification side exists for a reason the post states plainly. Dependencies are the most commonly attacked part of the software supply chain, and every artifact you consume, including transitively pulled-in binaries, has to be both legitimate and unchanged ^[5]. The worked example is a library called trusty-lib:1.0: if an attacker replaces it in the repository with a malicious build published under the same coordinates, your next build downloads the compromised code with no warning ^[6].

The Java platform's original answer was JAR signing, present at the latest in 1.2, where a signed JAR carries specific files in its META-INF folder ^[7]. The author's view is that it never became popular because the process was complicated, DevOps did not exist, and certificates were expensive ^[8]. What won instead was the weaker option: no signature, just a short fingerprint of the file, which guarantees integrity in the narrow sense that you got the exact file you intended ^[9]. You download, you hash, you compare against the advertised hash, and a mismatch means tampering ^[10].

Now the part that bites. Maven Central publishes a hash for every artifact, and the post reproduces the directory listing for log4j-slf4j2-impl 2.26.1 ^[11]. Each published file gets three companions: a .asc GPG signature, a .md5, and a .sha1 ^[12]. The primary files in that listing are the jar, the sources jar, the pom, a cyclonedx SBOM, and the .module Gradle Module Metadata file ^[13]. That is five artifacts, twenty lines, and ten checksums for a single version ^[15]. The .module file is not covered by the pom's checksums; it is a separate publication with its own .md5 and .sha1 ^[16].

Two consequences follow. First, a hash published next to the artifact it describes is only as trustworthy as the artifact, given an attacker who can overwrite coordinates, which is why the checksum records that matter are the ones committed to your own repository ^[18]. Second, and this is what breaks auto-merge: a version bump changes the coordinates, so every recorded hash for the old version is now irrelevant, and roughly ten new ones have to exist in the same commit as the bump before a verifying build can go green ^[17]. Renovate changes one line; the checksum ledger needs several new entries, including one for a file most people have never looked at ^[16][17].

What to watch is the ordering in your own pipeline: nothing can auto-merge until the regenerated checksums land alongside the version change, and any team enabling both features should push a deliberate bump through before trusting the bot. The supplied text of the post promises the full story and the fix ^[19], but it ends mid-sentence while describing the .asc signature file, so the remedy is not in the material available here ^[20].