Is there a way to add getAllowInsecureContinueWhenDisabled to all repositories automatically, including ones use for plugin resolution in settings.gradle? https://github.com/gradle/gradle/pull/36060 completely broke offline use cases. These reproducable build changes are so painful.

Yeah, security improvements are often annoying. You should probably use

--offline

when doing an offline build.

Ok. We'll just add that flag to all of our repositories manually.

But to answer your actual question, you can probably use

configureEach

on the repos from an init script, but you probably shouldn't.

IMO an offline repository isn't a supply chain attack. Because by definition it's offline and can't supply anything.

IMO an offline repository isn't a supply chain attack. Because by definition it's offline and can't supply anything

The point is, an attacker could make a repository offline by whatever means, DNS manipulation, DDOS attack, whatever. And then provide a malicious artifact in a repository that comes later in your list and where he got access to deploy a malicious artifact. Now if the repo where the dependency should actually have been retrieved from is offline, you still get a successful build, but with malicious artifacts. Besides that best-practice is anyway to use repository content filters when using multiple repositories to define exactly which dependency to take from which repository. As I said, if such situations do not affect you, for example because you use repository content filters or only internal repos and there need that offline fallback, then it might be fine to use that new flag, that's probably what it was added for.