{"record":{"id":"dc3cacd914b6f9e6","repo":"apple/pkl","slug":"expected-http-s-url-but-got","errorCode":null,"errorMessage":"Expected HTTP(S) URL, but got: ","messagePattern":"Expected HTTP\\(S\\) URL, but got: ","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/packages/PackageResolvers.java","lineNumber":197,"sourceCode":"      // To avoid having to update checksum values in their PklProject.deps.json files, every time\n      // a package changes, we set their checksum value to \"$skipChecksumVerification\".\n      // We keep two tests that do test checksum verification.\n      if (IoUtils.isTestMode() && expectedChecksum.equals(\"$skipChecksumVerification\")) {\n        return;\n      }\n      if (!checksum.equals(expectedChecksum)) {\n        throw new PackageLoadError(\n            \"invalidPackageMetadataChecksum\",\n            packageUri.getDisplayName(),\n            checksum,\n            expectedChecksum,\n            requestUri);\n      }\n    }\n\n    protected InputStream openExternalUri(URI uri) throws SecurityManagerException {\n      if (!HttpUtils.isHttpUrl(uri)) {\n        throw new IllegalArgumentException(\"Expected HTTP(S) URL, but got: \" + uri);\n      }\n\n      // treat package assets as resources instead of modules\n      securityManager.checkReadResource(uri);\n      var request = HttpRequest.newBuilder(uri).build();\n      HttpResponse<InputStream> response;\n      try {\n        response =\n            httpClient.send(\n                request, BodyHandlers.ofInputStream(), securityManager::checkReadResource);\n      } catch (IOException e) {\n        throw new PackageLoadError(e, \"ioErrorMakingHttpGet\", uri, e.getMessage());\n      }\n      try {\n        HttpUtils.checkHasStatusCode200(response);\n      } catch (IOException e) {\n        throw new PackageLoadError(\"badHttpStatusCode\", response.statusCode(), response.uri());\n      }","sourceCodeStart":179,"sourceCodeEnd":215,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/packages/PackageResolvers.java#L179-L215","documentation":"openExternalUri only knows how to fetch package resources over HTTP(S); it throws IllegalArgumentException \"Expected HTTP(S) URL, but got: ...\" when the URI uses another scheme. This is an internal guard — the package resolver was handed a non-HTTP URI (file:, https-less custom scheme, malformed URI, etc.).","triggerScenarios":"A package URI, package zip URL, or asset URL in dependency metadata resolves to a non-HTTP(S) scheme (e.g. file://, s3://) or a malformed URI string that still parses as a URI with a non-http(s) scheme; inputStream then routes it to openExternalUri.","commonSituations":"A locally edited DependencyMetadata.json or PklProjectDependencies.json contains a file:// or custom-scheme URL; a typo in a repository base URL; custom PackageResolvers subclass passing the wrong URI kind.","solutions":["Check the URL printed in the error and correct it to an http:// or https:// URL in the metadata/project file.","Fix the repository base URL in your PklProject or environment so dependent URLs are absolute HTTP(S).","If you subclassed PackageResolvers, ensure openExternalUri is only called with HTTP(S) URIs and handle other schemes yourself.","Verify the package metadata on the remote repository hasn't been hand-edited to non-HTTP URLs."],"exampleFix":"// before\n\"packageZipUrl\": \"file:///opt/pkl/my-pkg.zip\"\n// after\n\"packageZipUrl\": \"https://example.com/pkl/my-pkg-1.0.0.zip\"","handlingStrategy":"validation","validationCode":"// check all package URLs in metadata are HTTP(S) before resolving\n// jq -r '.. | strings | select(test(\"^[a-z]+://\"))' DependencyMetadata.json | grep -Ev '^https?://' && echo 'found non-HTTP(S) URL' || echo ok","typeGuard":"// Java: guard before calling resolvers that require HTTP\nstatic boolean isHttpUri(URI uri) {\n  String s = uri.getScheme();\n  return s != null && (s.equalsIgnoreCase(\"http\") || s.equalsIgnoreCase(\"https\"));\n}","tryCatchPattern":null,"preventionTips":["Always use absolute https:// URLs in package metadata and project files.","Don't hand-edit DependencyMetadata.json.","Validate repository base URLs when setting up custom registries."],"tags":["pkl","url","package-management"],"backgroundTag":"invalid-url-format","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}