{"record":{"id":"4634d4b97076db4f","repo":"gradle/gradle","slug":"attempting-to-download-java-toolchain-from-an-inse","errorCode":null,"errorMessage":"Attempting to download java toolchain from an insecure URI {}. This is not supported, use a secure URI instead.","messagePattern":"Attempting to download java toolchain from an insecure URI (.+?)\\. This is not supported, use a secure URI instead\\.","errorType":"exception","errorClass":"InvalidUserCodeException","httpStatus":null,"severity":"error","filePath":"platforms/jvm/toolchains-jvm-shared/src/main/java/org/gradle/jvm/toolchain/internal/install/JavaToolchainHttpRedirectVerifierFactory.java","lineNumber":36,"sourceCode":"\nimport org.gradle.api.InvalidUserCodeException;\nimport org.gradle.internal.service.scopes.Scope;\nimport org.gradle.internal.service.scopes.ServiceScope;\nimport org.gradle.internal.verifier.HttpRedirectVerifier;\nimport org.gradle.internal.verifier.HttpRedirectVerifierFactory;\n\nimport java.net.URI;\nimport java.net.URISyntaxException;\n\n@ServiceScope(Scope.Global.class)\npublic class JavaToolchainHttpRedirectVerifierFactory {\n\n    public HttpRedirectVerifier createVerifier(URI toolchainUri) {\n        final HttpRedirectVerifier redirectVerifier;\n        try {\n            redirectVerifier = HttpRedirectVerifierFactory.create(new URI(toolchainUri.getScheme(), toolchainUri.getAuthority(), null, null, null), false,\n                () -> {\n                    throw new InvalidUserCodeException(\"Attempting to download java toolchain from an insecure URI \" + toolchainUri + \". This is not supported, use a secure URI instead.\");\n                },\n                uri -> {\n                    throw new InvalidUserCodeException(\"Attempting to download java toolchain from an insecure URI \" + uri +\n                        \". This URI was reached as a redirect from \" + toolchainUri + \". This is not supported, make sure no insecure URIs appear in the redirect\");\n                });\n        } catch (URISyntaxException e) {\n            throw new InvalidUserCodeException(\"Cannot extract host information from specified URI \" + toolchainUri);\n        }\n        return redirectVerifier;\n    }\n}\n","sourceCodeStart":18,"sourceCodeEnd":48,"githubUrl":"https://github.com/gradle/gradle/blob/534f27719b66953f95cc907aae7f2c1b12f5482d/platforms/jvm/toolchains-jvm-shared/src/main/java/org/gradle/jvm/toolchain/internal/install/JavaToolchainHttpRedirectVerifierFactory.java#L18-L48","documentation":"Before downloading a toolchain archive, JavaToolchainHttpRedirectVerifierFactory.createVerifier builds an HttpRedirectVerifier in strict mode (allowInsecureProtocol=false); its insecure-URI callback throws InvalidUserCodeException when the configured download URI itself uses a non-secure scheme such as http://. Gradle deliberately blocks plaintext downloads of toolchain binaries because they execute with build privileges.","triggerScenarios":"A toolchain resolution rule in settings.gradle toolchainManagement.repositories sets the ToolchainDownload URI to an http:// (or otherwise insecure) URL and provisioning starts.","commonSituations":"Internal Artifactory/Nexus mirror published over plain http; copied vendor URL with a scheme typo; air-gapped environments where TLS was never set up on the mirror.","solutions":["Change the toolchain archive URL to https://","Enable TLS on the internal mirror (most Nexus/Artifactory deployments support it out of the box)","If a proxy is required, set systemProp.https.proxyHost/proxyPort and keep the artifact URL on https"],"exampleFix":"// before - settings.gradle.kts\nrepositories { myMirror { resolutionStrategy { it.path.set(\"http://nexus.internal/jdk-17.tar.gz\") } } }\n\n// after\nrepositories { myMirror { resolutionStrategy { it.path.set(\"https://nexus.internal/jdk-17.tar.gz\") } } }","handlingStrategy":"validation","validationCode":"// in settings, assert the scheme before wiring the repository\nassert uri.scheme == 'https': \"toolchain downloads must use https, got ${uri.scheme}\"","typeGuard":"boolean isSecureToolchainUri(URI uri) {\n    return \"https\".equalsIgnoreCase(uri.getScheme());\n}","tryCatchPattern":null,"preventionTips":["Standardize on https URLs in all toolchain resolution rules","Add TLS to internal mirrors instead of whitelisting http exceptions","Lint settings files for http:// toolchain URLs"],"tags":["gradle","java-toolchain","download","security","https"],"backgroundTag":"insecure-protocol-blocked","analyzedSha":"534f27719b66953f95cc907aae7f2c1b12f5482d","analyzedAt":"2026-08-22T08:09:12.375Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}