@gradle now offers complete verification of all the artifacts it downloads and uses, as of v6.2. gradle-witness and others were always limited to a small subset. It is time to switch to the built-in verification: https://docs.gradle.org/current/userguide/dependency_verification.html