[Codex Web] Bazel unable to download maven dependencies

What issue are you seeing?

I'm working on a Bazel repository that is using rules_jvm_external, and the setup script fails when performing the first build and trying to download maven dependencies:

mise ~/.config/mise/config.toml tools: java@21.0.2
Running setup scripts...
+ set +x
+ bazel build --noshow_progress --ui_event_filters=-warning //...
2026/04/12 19:43:35 Downloading https://releases.bazel.build/9.0.1/release/bazel-9.0.1-linux-x86_64...
Extracting Bazel installation...
Starting local Bazel server (9.0.1) and connecting to it...
INFO: Invocation ID: 7cdf9aeb-2a37-4272-8eb9-fee15a31defd
INFO: Repo rules_jvm_external++maven+maven defined by rule coursier_fetch in @@rules_jvm_external+//private/rules:coursier.bzl
ERROR: /root/.cache/bazel/_bazel_root/7405966fad6ca7862c1ea4387ccfd99a/external/rules_jvm_external+/private/rules/coursier.bzl:1114:13: An error occurred during the fetch of repository 'rules_jvm_external++maven+maven':
   Traceback (most recent call last):
	File "/root/.cache/bazel/_bazel_root/7405966fad6ca7862c1ea4387ccfd99a/external/rules_jvm_external+/private/rules/coursier.bzl", line 1243, column 38, in _coursier_fetch_impl
		dep_tree = make_coursier_dep_tree(
	File "/root/.cache/bazel/_bazel_root/7405966fad6ca7862c1ea4387ccfd99a/external/rules_jvm_external+/private/rules/coursier.bzl", line 1114, column 13, in make_coursier_dep_tree
		fail("Error while fetching artifact with coursier: " + exec_result.stderr)
Error in fail: Error while fetching artifact with coursier: OpenJDK 64-Bit Server VM warning: Options -Xverify:none and -noverify were deprecated in JDK 13 and will likely be removed in a future release.
Resolution error: Error downloading com.google.guava:failureaccess:1.0.1
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.pom
Error downloading com.google.auto.value:auto-value-annotations:1.11.0
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/com/google/auto/value/auto-value-annotations/1.11.0/auto-value-annotations-1.11.0.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/com/google/auto/value/auto-value-annotations/1.11.0/auto-value-annotations-1.11.0.pom
Error downloading io.netty:netty-codec:4.1.127.Final
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/io/netty/netty-codec/4.1.127.Final/netty-codec-4.1.127.Final.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/io/netty/netty-codec/4.1.127.Final/netty-codec-4.1.127.Final.pom
Error downloading io.perfmark:perfmark-api:0.27.0
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/io/perfmark/perfmark-api/0.27.0/perfmark-api-0.27.0.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/io/perfmark/perfmark-api/0.27.0/perfmark-api-0.27.0.pom
Error downloading io.opencensus:opencensus-api:0.31.0
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/io/opencensus/opencensus-api/0.31.0/opencensus-api-0.31.0.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/io/opencensus/opencensus-api/0.31.0/opencensus-api-0.31.0.pom
Error downloading com.google.auth:google-auth-library-oauth2-http:1.40.0
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/com/google/auth/google-auth-library-oauth2-http/1.40.0/google-auth-library-oauth2-http-1.40.0.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/com/google/auth/google-auth-library-oauth2-http/1.40.0/google-auth-library-oauth2-http-1.40.0.pom
Error downloading io.netty:netty-transport:4.1.127.Final
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/io/netty/netty-transport/4.1.127.Final/netty-transport-4.1.127.Final.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/io/netty/netty-transport/4.1.127.Final/netty-transport-4.1.127.Final.pom
Error downloading com.google.code.gson:gson:2.12.1
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/com/google/code/gson/gson/2.12.1/gson-2.12.1.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/com/google/code/gson/gson/2.12.1/gson-2.12.1.pom
Error downloading com.google.truth:truth:1.4.5
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/com/google/truth/truth/1.4.5/truth-1.4.5.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/com/google/truth/truth/1.4.5/truth-1.4.5.pom
Error downloading com.google.api.grpc:proto-google-common-protos:2.63.1
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/com/google/api/grpc/proto-google-common-protos/2.63.1/proto-google-common-protos-2.63.1.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/com/google/api/grpc/proto-google-common-protos/2.63.1/proto-google-common-protos-2.63.1.pom
Error downloading io.netty:netty-transport-native-unix-common:4.1.127.Final
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/io/netty/netty-transport-native-unix-common/4.1.127.Final/netty-transport-native-unix-common-4.1.127.Final.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/io/netty/netty-transport-native-unix-common/4.1.127.Final/netty-transport-native-unix-common-4.1.127.Final.pom
Error downloading com.squareup.okio:okio:2.10.0
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://repo.maven.apache.org/maven2/com/squareup/okio/okio/2.10.0/okio-2.10.0.pom
  download error: Caught javax.net.ssl.SSLHandshakeException ((certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target) while downloading https://maven.google.com/com/squareup/okio/okio/2.10.0/okio-2.10.0.pom
[...]

What steps can reproduce the bug?

Set up a bazel workspace using rules_jvm_external and build it.

What is the expected behavior?

_No response_

Additional information

I'm happy to provide a self contained sample to reproduce if you don't know what could be happening here at first sight :-)