Analysis on Maven projects failing due to certificate validation error against Maven Central artefacts

[rvesse]

At some point in the last week CodeQL jobs across our repositories started failing. Sampling our repositories Action history this starting happening approximately 4-5 days ago e.g.

Note that it's hard to pinpoint an exact point in time where this happened as repositories have varying levels of activity. There is no common factor of change that we can identify across these repositories. Some of the failures were triggered by our developers opening PR, but others were triggered by automated PRs from tools like Dependabot (e.g. the 3rd example job below). For repositories where no builds have been triggered, or no PRs opened in the time window, then we see no failures and the most recent run from 5+ days ago was successful.

The following are some example failing jobs across several repositories, and branches thereof, in our organisation:

• https://github.com/telicent-oss/smart-caches-core/actions/runs/12947315333/job/36224632277
• https://github.com/telicent-oss/smart-caches-core/actions/runs/12947315333/job/36224632277
• https://github.com/telicent-oss/rdf-abac/actions/runs/12976261418/job/36188305613

Looking in the job logs we see a bunch of errors from CodeQL, but looking through the job logs the root cause looks to be the following:

[2025-01-27 13:31:57] [build-stdout] [2025-01-27 13:31:57] [autobuild] The following artifacts could not be resolved: org.apache.maven.plugins:maven-assembly-plugin:pom:3.7.1 (absent): Could not transfer artifact org.apache.maven.plugins:maven-assembly-plugin:pom:3.7.1 from/to central (https://repo.maven.apache.org/maven2): PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

For some reason the CodeQL job/tools doesn't seem to have the right certificates available to verify the certificate of Maven Central?? Thus it won't download the Maven dependencies and fails the entire job.

A quick check in my browser shows that the certificate on repo.maven.apache.org appears valid AFAICT:

What's going on here?

[rvermeulen]

Hi @rvesse,

Thanks for reporting this. We will look into this and report back a soon as possible.

[rvermeulen]

Hi @rvesse,

We have been able to replicate and are working on a fix to ensure we can download the necessary dependencies again. Keep you posted.