Useful error message for PKIX path building failure with standard switches about gradle

[ov7a]

You can debug the connection using -Djavax.net.debug=all:

gradle --refresh-dependencies -Djavax.net.ssl.trustStore=./dummy.jks -Djavax.net.debug=all build

It will print stacktraces, handshakes, and errors.

[monolied]

Ah. My bad. When I changed GRADLE_USER_HOME to something else, the proxy configuration was gone, too. So later tests without build cache and empty home, but with using -Djavax.net.debug=all failed - albeit for an entirely different reason than before: without proxy gradle couldn't connect at all, and since the final error output is indistinguishable from the one before, I was led to believe nothing had changed. Only when I realised gradle was spending 3 minutes in <======-------> 50% CONFIGURING [2m 59s], I thought something was amiss.

In fact, -Djavax.net.debug=all does show the sun.security.validator.ValidatorException: PKIX path building failed
when used with an appropriate handful of switches (--no-daemon, --refresh-dependencies, --no-build-cache).

(-Djava.security.debug=ssl doesn't. )

So thanks a lot for your help!

[monolied]

Hm.

gradle -V --refresh-dependencies -Djavax.net.debug=all -Djavax.net.ssl.trustStore=./dummy.jks build
------------------------------------------------------------
Gradle 8.6
------------------------------------------------------------

Build time:   2024-02-02 16:47:16 UTC
Revision:     d55c486870a0dc6f6278f53d21381396d0741c6e

Kotlin:       1.9.20
Groovy:       3.0.17
Ant:          Apache Ant(TM) version 1.10.13 compiled on January 4 2023
JVM:          17.0.11 (Eclipse Adoptium 17.0.11+9)
OS:           Linux 6.1.0-20-amd64 amd64


FAILURE: Build failed with an exception.

* Where:
Build file '/daten/ci/jenkins/workspace/weBBservice-Dev/webbservice/build.gradle' line: 4

* What went wrong:
Plugin [id: 'org.springframework.boot', version: '3.2.5'] was not found in any of the following sources:

- Gradle Core Plugins (plugin is not in 'org.gradle' namespace)
- Plugin Repositories (could not resolve plugin artifact 'org.springframework.boot:org.springframework.boot.gradle.plugin:3.2.5')
  Searched in the following repositories:
    Gradle Central Plugin Repository

* Try:
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.
> Get more help at https://help.gradle.org.

BUILD FAILED in 540ms

[ov7a]

@monolied make sure that this is not a reused result from cache.
The simplest way to do this is to remove ./build directories and start with a clean gradle home (export GRADLE_USER_HOME=./gradle_home)

[monolied]

I was using --no-build-cache and thought that would avoid issues like that... Also In that case I'd be stumped by --scan showing the PKIX issues. Also, that wouldn't explain the build working when I use a sufficient keystore.

I gave it a try, however. When I set GRADLE_USER_HOME to an empty /tmp/gradletest after deleting ./build, I do see in fact a lot of output regarding certificates, but that is only about loading the handful of certificates from the keystore. After that, the failure message is like above, ie doesn't contain the certificate error.
So no; it seems to be pretty much independent of cache. Thank you for that proposal, however; it might be helpful in different circumstances.
(I was thinking if maybe the somewhat exotic Temurin 17 JDK uses error messages for PKIX path building that don't get recognized by gradle, for whatever reason, and therefore are suppressed. Except, for other inexplicable reasons, when using --scan.)

[ov7a]

You are correct about the caches; I was too cautious.

Can you provide the error you're observing in the scan?

It's really strange that the error is not captured with -Djavax.net.debug=all. Gradle uses Apache HTTP client under the hood, which in turn relies on JDK primitives, so -Djavax.net.debug=all should be sufficient to catch common errors.

Can you also try -Djava.security.debug=ssl?