Support configuring HTTP version downgrade to workaround download errors with ZScaler VPN

[sven-binnig]

Actual behavior

Installing a tool in a project context, which needs java (eg. IntelliJ, Eclipse, az, aws, jmc, mvn ...) cannot download java, e.g. from following sources

• https://github.com/adoptium/temurin24-binaries/releases/download/jdk-24.0.1%2B9/OpenJDK24U-jdk_x64_windows_hotspot_24.0.1_9.zip
• https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.10%2B7/OpenJDK17U-jdk_x64_windows_hotspot_17.0.10_7.zip

Complete stacktrace installing jmc :

Failed to download from https://github.com/adoptium/temurin24-binaries/releases/download/jdk-24.0.1%2B9/OpenJDK24U-jdk_x64_windows_hotspot_24.0.1_9.zip
java.lang.IllegalStateException: Failed to download file from URL https://github.com/adoptium/temurin24-binaries/releases/download/jdk-24.0.1%2B9/OpenJDK24U-jdk_x64_windows_hotspot_24.0.1_9.zip to C:\projects\_ide\tmp\Downloads\java-24.0.1_9-windows-x64.zip
        at com.devonfw.tools.ide.io.FileAccessImpl.download(FileAccessImpl.java:124)
        at com.devonfw.tools.ide.tool.repository.AbstractToolRepository.download(AbstractToolRepository.java:185)
        at com.devonfw.tools.ide.tool.repository.AbstractToolRepository.download(AbstractToolRepository.java:113)
        at com.devonfw.tools.ide.tool.repository.AbstractToolRepository.doDownload(AbstractToolRepository.java:93)
        at com.devonfw.tools.ide.tool.repository.AbstractToolRepository.download(AbstractToolRepository.java:76)
        at com.devonfw.tools.ide.tool.repository.AbstractToolRepository.download(AbstractToolRepository.java:59)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.downloadTool(LocalToolCommandlet.java:238)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.installTool(LocalToolCommandlet.java:216)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.installTool(LocalToolCommandlet.java:169)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.installAsDependency(LocalToolCommandlet.java:266)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.installToolDependencies(LocalToolCommandlet.java:278)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.installTool(LocalToolCommandlet.java:188)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.installTool(LocalToolCommandlet.java:169)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.doInstallStep(LocalToolCommandlet.java:89)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.install(LocalToolCommandlet.java:79)
        at com.devonfw.tools.ide.tool.ToolCommandlet.install(ToolCommandlet.java:262)
        at com.devonfw.tools.ide.commandlet.InstallCommandlet.run(InstallCommandlet.java:77)
        at com.devonfw.tools.ide.context.AbstractIdeContext.applyAndRun(AbstractIdeContext.java:988)
        at com.devonfw.tools.ide.context.AbstractIdeContext.run(AbstractIdeContext.java:897)
        at com.devonfw.tools.ide.cli.Ideasy.runOrThrow(Ideasy.java:95)
        at com.devonfw.tools.ide.cli.Ideasy.run(Ideasy.java:59)
        at com.devonfw.tools.ide.cli.Ideasy.main(Ideasy.java:133)
        at java.base@23.0.2/java.lang.invoke.LambdaForm$DMH/sa346b79c.invokeStaticInit(LambdaForm$DMH)
Caused by: java.io.IOException: EOF reached while reading
        at java.net.http@23.0.2/jdk.internal.net.http.HttpClientImpl.send(HttpClientImpl.java:971)
        at java.net.http@23.0.2/jdk.internal.net.http.HttpClientFacade.send(HttpClientFacade.java:133)
        at com.devonfw.tools.ide.io.FileAccessImpl.download(FileAccessImpl.java:104)
        ... 22 more
Caused by: java.io.EOFException: EOF reached while reading
        at java.net.http@23.0.2/jdk.internal.net.http.Http2Connection$Http2TubeSubscriber.onComplete(Http2Connection.java:1832)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SSLTube$DelegateWrapper.onComplete(SSLTube.java:276)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SSLTube$SSLSubscriberWrapper.complete(SSLTube.java:440)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SSLTube$SSLSubscriberWrapper.onComplete(SSLTube.java:541)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SubscriberWrapper.checkCompletion(SubscriberWrapper.java:474)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SubscriberWrapper$DownstreamPusher.run1(SubscriberWrapper.java:334)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SubscriberWrapper$DownstreamPusher.run(SubscriberWrapper.java:259)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$LockingRestartableTask.run(SequentialScheduler.java:182)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$CompleteRestartableTask.run(SequentialScheduler.java:149)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$SchedulableTask.run(SequentialScheduler.java:207)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler.runOrSchedule(SequentialScheduler.java:280)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler.runOrSchedule(SequentialScheduler.java:233)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SubscriberWrapper.outgoing(SubscriberWrapper.java:232)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SSLFlowDelegate$Reader.processData(SSLFlowDelegate.java:540)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SSLFlowDelegate$Reader$ReaderDownstreamPusher.run(SSLFlowDelegate.java:283)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$LockingRestartableTask.run(SequentialScheduler.java:182)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$CompleteRestartableTask.run(SequentialScheduler.java:149)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$SchedulableTask.run(SequentialScheduler.java:207)
        at java.base@23.0.2/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
        at java.base@23.0.2/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
        at java.base@23.0.2/java.lang.Thread.runWith(Thread.java:1588)
        at java.base@23.0.2/java.lang.Thread.run(Thread.java:1575)
        at org.graalvm.nativeimage.builder/com.oracle.svm.core.thread.PlatformThreads.threadStartRoutine(PlatformThreads.java:832)
        at org.graalvm.nativeimage.builder/com.oracle.svm.core.thread.PlatformThreads.threadStartRoutine(PlatformThreads.java:808)

This behaviour accours since 06-24-25 ~ 15:00

Reproduce

within a project:
ide install jmc

Expected behavior

ide install jmc should install the software and its dependencies

IDEasy status

IDE_ROOT is set to C:\projects
IDE_HOME is set to C:\projects\p-1
You are online.
Your settings are up-to-date.
Found legacy properties C:\projects\p-1\conf\devon.properties
Found legacy properties C:\projects\p-1\settings\devon.properties
Your settings are outdated and contain legacy configurations. Please consider upgrading your settings:
https://github.com/devonfw/IDEasy/blob/main/documentation/settings.adoc#upgrade
Your version of IDEasy is 2025.06.001 which is the latest released version.
Your operating system is windows(10.0)@x64 [Windows 11@amd64]
Successfully completed ide (status)

Related/Dependent issues

No response

Comments/Hints

No response

[sven-binnig]

Perhaps an issue with server certificates with github?
If this is true: who could be affected by this issue?

[hohwille]

@sven-binnig thanks for reporting this issue.
The URL of the download seems correct and in general for download we are using the HTTP client included in the JDK since Java9 which is usually robust and reliable.
Therefore, my first assumption would be that you are seeing a network issue - most likely due to VPN technology (ZScaler is a famous candidate for causing such problems) or corporate gateways (see https://infra.apache.org/infra-ban.html).

I just did a simple test of your scenario without any issues:

$ ide install java 17.0.10_7
Updates are available for the settings repository. If you want to apply the latest changes, call "ide update"
JAVA_VERSION=17.0.10_7 has been set in SETTINGS@D:\projects\test\settings\ide.properties
Artifact already exists at C:\Users\hohwille\Downloads\ide\default\java-17.0.10_7-windows-x64.zip
To force update please delete the file and run again.
Extracting ZIP file C:\Users\hohwille\Downloads\ide\default\java-17.0.10_7-windows-x64.zip to D:\projects\_ide\tmp\extract-java-17.0.10_7-windows-x64.zip
Extracting 100% [=================================================================================================================================================================================================================] 301/301MiB (0:00:05 / 0:00:00) 60.3MiB/s
Successfully installed java in version 17.0.10_7 replacing previous version 8u412b08

So as you can see there is not a general bug in IDEasy causing this.
Can you test to download the Link in your network with other tools like

• browser
• curl
• wget
  ?

[sven-binnig]

• Download with browser works
• Download with wget -> not installed on system
• Download with curl -> does not work:

$ curl https://github.com/adoptium/temurin24-binaries/releases/download/jdk-24.0.1%2B9/OpenJDK24U-jdk_x64_windows_hotspot_24.0.1_9.zip
curl: (35) schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - Die Sperrfunktion konnte keine Sperrprüfung für das Zertifikat durchführen.

[hohwille]

@sven-binnig Thanks for testing!

next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) -
Die Sperrfunktion konnte keine Sperrprüfung für das Zertifikat durchführen.

If you are facing TLS issues with faked ZScaler certificates there is a solution offered by IDEasy:

• https://github.com/devonfw/IDEasy/blob/main/documentation/proxy-support.adoc#truststore
• HTTP Proxy with TLS termination causing errors #897

[sven-binnig]

I have already set env var IDE_OPTION for SSL stuff (IDE_OPTIONS=-Dhttps.proxyHost=a.b.c.d -Dhttps.proxyPort=8080 -Djava.net.ssl.trustStore=c:\windows\win.ini -Djavax.net.ssl.trustStoreType=Windows-ROOT).
I could try "the long ways" but I don't think that it would save the problem.

[sven-binnig]

Update:
We have a internal certifacte problem:
It appears that certificates are no longer recognized as valid, even though they were issued by the ****. Certificate Management is aware of the issue and is addressing it.

As Mr. Beckenbauer said: "schau 'mer mal" ....

[sven-binnig]

Update:
ide install vscode ends up in

Trying to download vscode-1.101.2-windows-x64.zip from https://update.code.visualstudio.com/1.101.2/win32-x64-archive/stable
Failed to download from https://update.code.visualstudio.com/1.101.2/win32-x64-archive/stable
java.lang.IllegalStateException: Failed to download file from URL https://update.code.visualstudio.com/1.101.2/win32-x64-archive/stable to C:\projects\_ide\tmp\Downloads\vscode-1.101.2-windows-x64.zip
        at com.devonfw.tools.ide.io.FileAccessImpl.download(FileAccessImpl.java:126)
        at com.devonfw.tools.ide.tool.repository.AbstractToolRepository.download(AbstractToolRepository.java:185)
        at com.devonfw.tools.ide.tool.repository.AbstractToolRepository.download(AbstractToolRepository.java:113)
        at com.devonfw.tools.ide.tool.repository.AbstractToolRepository.doDownload(AbstractToolRepository.java:93)
        at com.devonfw.tools.ide.tool.repository.AbstractToolRepository.download(AbstractToolRepository.java:76)
        at com.devonfw.tools.ide.tool.repository.AbstractToolRepository.download(AbstractToolRepository.java:59)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.downloadTool(LocalToolCommandlet.java:239)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.installTool(LocalToolCommandlet.java:217)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.installTool(LocalToolCommandlet.java:170)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.doInstallStep(LocalToolCommandlet.java:90)
        at com.devonfw.tools.ide.tool.LocalToolCommandlet.install(LocalToolCommandlet.java:80)
        at com.devonfw.tools.ide.tool.ide.IdeToolCommandlet.install(IdeToolCommandlet.java:62)
        at com.devonfw.tools.ide.tool.ToolCommandlet.install(ToolCommandlet.java:262)
        at com.devonfw.tools.ide.commandlet.InstallCommandlet.run(InstallCommandlet.java:77)
        at com.devonfw.tools.ide.context.AbstractIdeContext.applyAndRun(AbstractIdeContext.java:1098)
        at com.devonfw.tools.ide.context.AbstractIdeContext.run(AbstractIdeContext.java:1008)
        at com.devonfw.tools.ide.cli.Ideasy.runOrThrow(Ideasy.java:95)
        at com.devonfw.tools.ide.cli.Ideasy.run(Ideasy.java:59)
        at com.devonfw.tools.ide.cli.Ideasy.main(Ideasy.java:133)
        at java.base@23.0.2/java.lang.invoke.LambdaForm$DMH/sa346b79c.invokeStaticInit(LambdaForm$DMH)
Caused by: java.io.IOException: EOF reached while reading
        at java.net.http@23.0.2/jdk.internal.net.http.HttpClientImpl.send(HttpClientImpl.java:971)
        at java.net.http@23.0.2/jdk.internal.net.http.HttpClientFacade.send(HttpClientFacade.java:133)
        at com.devonfw.tools.ide.io.FileAccessImpl.download(FileAccessImpl.java:106)
        ... 19 more
Caused by: java.io.EOFException: EOF reached while reading
        at java.net.http@23.0.2/jdk.internal.net.http.Http2Connection$Http2TubeSubscriber.onComplete(Http2Connection.java:1832)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SSLTube$DelegateWrapper.onComplete(SSLTube.java:276)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SSLTube$SSLSubscriberWrapper.complete(SSLTube.java:440)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SSLTube$SSLSubscriberWrapper.onComplete(SSLTube.java:541)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SubscriberWrapper.checkCompletion(SubscriberWrapper.java:474)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SubscriberWrapper$DownstreamPusher.run1(SubscriberWrapper.java:334)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SubscriberWrapper$DownstreamPusher.run(SubscriberWrapper.java:259)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$LockingRestartableTask.run(SequentialScheduler.java:182)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$CompleteRestartableTask.run(SequentialScheduler.java:149)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$SchedulableTask.run(SequentialScheduler.java:207)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler.runOrSchedule(SequentialScheduler.java:280)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler.runOrSchedule(SequentialScheduler.java:233)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SubscriberWrapper.outgoing(SubscriberWrapper.java:232)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SSLFlowDelegate$Reader.processData(SSLFlowDelegate.java:540)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SSLFlowDelegate$Reader$ReaderDownstreamPusher.run(SSLFlowDelegate.java:283)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$LockingRestartableTask.run(SequentialScheduler.java:182)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$CompleteRestartableTask.run(SequentialScheduler.java:149)
        at java.net.http@23.0.2/jdk.internal.net.http.common.SequentialScheduler$SchedulableTask.run(SequentialScheduler.java:207)
        at java.base@23.0.2/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
        at java.base@23.0.2/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
        at java.base@23.0.2/java.lang.Thread.runWith(Thread.java:1588)
        at java.base@23.0.2/java.lang.Thread.run(Thread.java:1575)
        at org.graalvm.nativeimage.builder/com.oracle.svm.core.thread.PlatformThreads.threadStartRoutine(PlatformThreads.java:832)
        at org.graalvm.nativeimage.builder/com.oracle.svm.core.thread.PlatformThreads.threadStartRoutine(PlatformThreads.java:808)

But curl on same url works fine:

% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                Dload  Upload   Total   Spent    Left  Speed

 0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 10.23.148.36:8085...
* CONNECT tunnel: HTTP/1.1 negotiated
* allocate connect buffer
* Establish HTTP proxy tunnel to update.code.visualstudio.com:443
> CONNECT update.code.visualstudio.com:443 HTTP/1.1
> Host: update.code.visualstudio.com:443
> User-Agent: curl/8.13.0
> Proxy-Connection: Keep-Alive
> 
< HTTP/1.1 200 Connection established
< 
* CONNECT phase completed
* CONNECT tunnel established, response 200
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* ALPN: server accepted http/1.1
* Connected to 10.23.148.36 (10.23.148.36) port 8085
* using HTTP/1.x
> GET /1.101.2/win32-x64-archive/stable HTTP/1.1
> Host: update.code.visualstudio.com
> User-Agent: curl/8.13.0
> Accept: */*
> 
* Request completely sent off
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
* schannel: remote party requests renegotiation
* schannel: renegotiating SSL/TLS connection
* schannel: SSL/TLS connection renegotiated
< HTTP/1.1 302 Found
< Date: Mon, 07 Jul 2025 07:50:57 GMT
< Content-Type: text/plain; charset=utf-8
< Content-Length: 158
< Connection: keep-alive
< Access-Control-Allow-Origin: *
< Cache-Control: max-age=150
< Location: https://vscode.download.prss.microsoft.com/dbazure/download/stable/2901c5ac6db8a986a5666c3af51ff804d05af0d4/VSCode-win32-x64-1.101.2.zip
< Vary: Accept
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< request-context: appId=cid-v1:8109e553-6232-492a-afca-b78cea9b431c
< X-Powered-By: Express
< X-Content-Type-Options: nosniff
< X-Source-Commit: 52c757d6039fc7b9fc4b210aec30978ae2805866
< X-SHA256: a9ab94db2dd7aadaca783ac5daf3e225725850e5765e430e29a9c3f5bee9317a
< x-azure-ref: 20250707T075057Z-17fb9ccb484r7z9fhC1FRAdfd400000015n0000000003hqq
< X-Cache: CONFIG_NOCACHE
< 
{ [158 bytes data]

100   158  100   158    0     0    973      0 --:--:-- --:--:-- --:--:--   969
100   158  100   158    0     0    972      0 --:--:-- --:--:-- --:--:--   969