{"record":{"id":"958e162d98516d45","repo":"apple/pkl","slug":"invalidpackagezipurl","errorCode":"invalidPackageZipUrl","errorMessage":"invalidPackageZipUrl","messagePattern":"invalidPackageZipUrl","errorType":"error_code","errorClass":"PackageLoadError","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/packages/PackageResolvers.java","lineNumber":402,"sourceCode":"    @Override\n    protected DependencyMetadata doGetDependencyMetadata(\n        PackageUri packageUri, @Nullable Checksums checksums)\n        throws IOException, SecurityManagerException {\n      var requestUri = packageUri.getMetadataRequestUri();\n      var inputStream = openExternalUri(requestUri);\n      if (checksums != null) {\n        inputStream = newDigestInputStream(inputStream);\n      }\n      try (var in = inputStream) {\n        var metadataStr = IoUtils.readString(in);\n        if (checksums != null) {\n          var digestInputStream = (DigestInputStream) in;\n          var checksumBytes = digestInputStream.getMessageDigest().digest();\n          verifyPackageMetadataBytes(packageUri, requestUri, checksums, checksumBytes);\n        }\n        var metadata = DependencyMetadata.parse(metadataStr);\n        if (!metadata.getPackageZipUrl().getScheme().equalsIgnoreCase(\"https\")) {\n          throw invalidPackageZipUrl(packageUri, metadata);\n        }\n        return metadata;\n      } catch (JsonParseException e) {\n        throw new PackageLoadError(\n            e,\n            \"invalidDependencyMetadata\",\n            packageUri.getDisplayName(),\n            requestUri,\n            e.getMessage());\n      }\n    }\n\n    @Override\n    public void close() throws IOException {\n      super.close();\n      synchronized (lock) {\n        cachedEntries.clear();\n        cachedTreePathElementRoots.clear();","sourceCodeStart":384,"sourceCodeEnd":420,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/packages/PackageResolvers.java#L384-L420","documentation":"Raised in `PackageResolvers.doGetDependencyMetadata` after parsing a package's dependency metadata: the parsed `PackageZipUrl` does not use the HTTPS scheme, so the resolver rejects it with `invalidPackageZipUrl` to prevent downloading package zips over insecure transport. This is a security guard on package-manager metadata.","triggerScenarios":"A dependency's metadata file (fetched from a package server) declares a `packageZipUrl` whose scheme is `http` (or any non-https scheme) — e.g. a self-hosted/custom package server publishing metadata with plain-HTTP zip URLs.","commonSituations":"Running a local or intranet package server that emits `http://` URLs; hand-authored or migrated dependency metadata; proxy setups that rewrite https URLs to http.","solutions":["Fix the package server/metadata so `packageZipUrl` uses `https://`.","If it's your own registry, configure it to advertise HTTPS endpoints (TLS termination in front of the storage).","Re-publish or update the affected package version's metadata, then clear any cached metadata and retry.","Use the official/standard Pkl package repository whose metadata always declares HTTPS URLs."],"exampleFix":"// before (metadata JSON)\n{ \"packageZipUrl\": \"http://registry.example.com/pkgs/my-pkg@1.0.0.zip\" }\n// after\n{ \"packageZipUrl\": \"https://registry.example.com/pkgs/my-pkg@1.0.0.zip\" }","handlingStrategy":"validation","validationCode":"function assertHttpsUrl(u) {\n  const url = new URL(u);\n  if (url.protocol !== \"https:\") throw new Error(`package zip URL must be https, got ${url.protocol}`);\n}","typeGuard":"function isHttpsUrl(u) { try { return new URL(u).protocol === \"https:\"; } catch { return false; } }","tryCatchPattern":"try {\n  const meta = loadDependencyMetadata(pkgUri);\n} catch (e) {\n  if (e.code === \"invalidPackageZipUrl\") { /* fix registry metadata or pin another version */ }\n}","preventionTips":["Run package servers behind TLS and advertise https URLs in metadata.","Validate metadata after publishing a package.","Pin packages to versions published on the standard HTTPS repository."],"tags":["pkl","packages","security","https","metadata"],"backgroundTag":"invalid-url","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}