write-verification-metadata fails with java.io.FileNotFoundException for many (not all) dependencies

[nhoughto]

I'm trying out the new dependency verification function, running gradle --write-verification-metadata sha256 on a quite complicated project, the configuration phase starts and things look ok, it is cycling through the many (110~) modules in the project, it eventually fail with a list of 50~ dependencies it can't find the pom file of, these files genuinely don't exist, so the FileNotFound is correct, but possibly the process is picking up transitive dependencies that have been resolved to a later version

Expected Behavior

Process should complete successfully, and the XML be updated with dependency hashes

Current Behavior

Throws many FileNotFounds

* What went wrong:
A build operation failed.
    java.io.FileNotFoundException: /Users/user/.gradle/caches/modules-2/files-2.1/net.java/jvnet-parent/5/5343c954d21549d039feebe5fadef023cdfc1388/jvnet-parent-5.pom (No such file or directory)
> java.io.FileNotFoundException: /Users/user/.gradle/caches/modules-2/files-2.1/net.java/jvnet-parent/5/5343c954d21549d039feebe5fadef023cdfc1388/jvnet-parent-5.pom (No such file or directory)

Context

Recently upgraded to 6.2 GA

Steps to Reproduce

1. Start with empty gradle cache, if the pom exists in cache it will succeed.
2. Run task ./gradlew --write-verification-metadata sha256 from example build.gradle below

apply plugin: 'java'

repositories {
  mavenCentral()
}

dependencies {
  implementation "javax.ws.rs:javax.ws.rs-api:2.0.1"
}

3. FileNotFound error

I've reduced the build.gradle for the repro, in this example there is just one failure, in the larger project there are many failures. There does seem to be some non-deterministic behaviour, i've had it succeed on the rate occasion, and then the file it is looking for exists. So possibly there is a race between fulfilling the metadata request and verifying it? It seems to only happen for some dependencies too, I cut this dependency out of a larger set and this is the only one that failed.

Your Environment

Build scan URL: https://scans.gradle.com/s/7b75xhdjpya3o

[nhoughto]

Strangely it seems a later version works everytime:

apply plugin: 'java'

repositories {
  mavenCentral()
}

dependencies {
  implementation "javax.ws.rs:javax.ws.rs-api:2.1.1"
}

The failure is on jvnet dependency which is the maven "parent" project of the dependency in question. The later version 2.1.1 no longer has this parent relationship, so likely this is due to some maven parent pom specific behaviour, thus why its dependency and version specific. 🕵

[nhoughto]

This repros on 6.2.1 as well