gradle/gradle · error · InvalidUserCodeException

Attempting to download java toolchain from an insecure URI {

Error message

Attempting to download java toolchain from an insecure URI {}. This is not supported, use a secure URI instead.

What it means

Before downloading a toolchain archive, JavaToolchainHttpRedirectVerifierFactory.createVerifier builds an HttpRedirectVerifier in strict mode (allowInsecureProtocol=false); its insecure-URI callback throws InvalidUserCodeException when the configured download URI itself uses a non-secure scheme such as http://. Gradle deliberately blocks plaintext downloads of toolchain binaries because they execute with build privileges.

Source

Thrown at platforms/jvm/toolchains-jvm-shared/src/main/java/org/gradle/jvm/toolchain/internal/install/JavaToolchainHttpRedirectVerifierFactory.java:36

import org.gradle.api.InvalidUserCodeException;
import org.gradle.internal.service.scopes.Scope;
import org.gradle.internal.service.scopes.ServiceScope;
import org.gradle.internal.verifier.HttpRedirectVerifier;
import org.gradle.internal.verifier.HttpRedirectVerifierFactory;

import java.net.URI;
import java.net.URISyntaxException;

@ServiceScope(Scope.Global.class)
public class JavaToolchainHttpRedirectVerifierFactory {

    public HttpRedirectVerifier createVerifier(URI toolchainUri) {
        final HttpRedirectVerifier redirectVerifier;
        try {
            redirectVerifier = HttpRedirectVerifierFactory.create(new URI(toolchainUri.getScheme(), toolchainUri.getAuthority(), null, null, null), false,
                () -> {
                    throw new InvalidUserCodeException("Attempting to download java toolchain from an insecure URI " + toolchainUri + ". This is not supported, use a secure URI instead.");
                },
                uri -> {
                    throw new InvalidUserCodeException("Attempting to download java toolchain from an insecure URI " + uri +
                        ". This URI was reached as a redirect from " + toolchainUri + ". This is not supported, make sure no insecure URIs appear in the redirect");
                });
        } catch (URISyntaxException e) {
            throw new InvalidUserCodeException("Cannot extract host information from specified URI " + toolchainUri);
        }
        return redirectVerifier;
    }
}

View on GitHub (pinned to 534f27719b)

Solutions

Change the toolchain archive URL to https://
Enable TLS on the internal mirror (most Nexus/Artifactory deployments support it out of the box)
If a proxy is required, set systemProp.https.proxyHost/proxyPort and keep the artifact URL on https

Example fix

// before - settings.gradle.kts
repositories { myMirror { resolutionStrategy { it.path.set("http://nexus.internal/jdk-17.tar.gz") } } }

// after
repositories { myMirror { resolutionStrategy { it.path.set("https://nexus.internal/jdk-17.tar.gz") } } }

Defensive patterns

Strategy: validation

Validate before calling

// in settings, assert the scheme before wiring the repository
assert uri.scheme == 'https': "toolchain downloads must use https, got ${uri.scheme}"

Type guard

boolean isSecureToolchainUri(URI uri) {
    return "https".equalsIgnoreCase(uri.getScheme());
}

Prevention

Standardize on https URLs in all toolchain resolution rules
Add TLS to internal mirrors instead of whitelisting http exceptions
Lint settings files for http:// toolchain URLs

When it happens

Trigger: A toolchain resolution rule in settings.gradle toolchainManagement.repositories sets the ToolchainDownload URI to an http:// (or otherwise insecure) URL and provisioning starts.

Common situations: Internal Artifactory/Nexus mirror published over plain http; copied vendor URL with a scheme typo; air-gapped environments where TLS was never set up on the mirror.

Related errors

AI-assisted analysis of gradle/gradle@534f27719b (2026-08-22). Data as JSON: /api/errors/4634d4b97076db4f. Report an issue: GitHub.