In a nutshell, no we are not respecting repository credentials in our dependency cache. We do cache separately per-repository, but at the moment 2 repositories with different credentials but the same artifact patterns are treated as identical for cache purposes.

If 2 different users share the same cache directory (gradle home), then they will also share cache entries from this cache. So if the first user has the correct credentials when running the build, the second user will be able to access the cached jar file for that build, even if the supplied credentials are incorrect.

This behaviour is not great, and something we should probably fix at some stage. Since 2 users don't normally share a gradle home folder, I don't imagine this being a common issue.

Hi Daz

Thanks for your explanation.

The reason the current behavior is an issue for us (though not a critical one), is that we often create Artifactory users with different permission sets and before I send the credentials to the appropriate person, I want to check on my machine that they are correct, i.e. sufficient to run a given build. This is currently not possible to do, unless I delete my local Gradle cache first.

Please consider this as a feature request.

As announced on the Gradle blog we are planning to completely migrate issues from JIRA to GitHub.

We intend to prioritize issues that are actionable and impactful while working more closely with the community. Many of our JIRA issues are inactionable or irrelevant. We would like to request your help to ensure we can appropriately prioritize JIRA issues you’ve contributed to.

Please confirm that you still advocate for your JIRA issue before December 10th, 2016 by:

• Checking that your issues contain requisite context, impact, behaviors, and examples as described in our published guidelines.
• Leave a comment on the JIRA issue or open a new GitHub issue confirming that the above is complete.

We look forward to collaborating with you more closely on GitHub. Thank you for your contribution to Gradle!

Thanks again for reporting this issue. We haven't heard back from you after our inquiry from November 15th. We are closing this issue now. Please create an issue on GitHub if you still feel passionate about getting it resolved.