I'm making a project that has dependencies (also made by me) that themselves depend on Bouncy Castle, which includes signature files for its jar, and if these are present in the shaded jar, the JVM sees the jar is not valid for those signatures and refuses to run it:
Error: A JNI error has occurred, please check your installation and try again
Exception in thread "main" java.lang.SecurityException: Invalid signature file digest for Manifest main attributes
at java.base/sun.security.util.SignatureFileVerifier.processImpl(SignatureFileVerifier.java:340)
at java.base/sun.security.util.SignatureFileVerifier.process(SignatureFileVerifier.java:282)
at java.base/java.util.jar.JarVerifier.processEntry(JarVerifier.java:320)
at java.base/java.util.jar.JarVerifier.update(JarVerifier.java:232)
at java.base/java.util.jar.JarFile.initializeVerifier(JarFile.java:760)
at java.base/java.util.jar.JarFile.getInputStream(JarFile.java:856)
at java.base/jdk.internal.loader.URLClassPath$JarLoader$2.getInputStream(URLClassPath.java:848)
at java.base/jdk.internal.loader.Resource.cachedInputStream(Resource.java:77)
at java.base/jdk.internal.loader.Resource.getByteBuffer(Resource.java:163)
at java.base/jdk.internal.loader.BuiltinClassLoader.defineClass(BuiltinClassLoader.java:853)
at java.base/jdk.internal.loader.BuiltinClassLoader.findClassOnClassPathOrNull(BuiltinClassLoader.java:760)
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:681)
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:639)
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)
at java.base/java.lang.Class.forName0(Native Method)
at java.base/java.lang.Class.forName(Class.java:534)
at java.base/java.lang.Class.forName(Class.java:513)
at java.base/sun.launcher.LauncherHelper.loadMainClass(LauncherHelper.java:797)
at java.base/sun.launcher.LauncherHelper.checkAndLoadMain(LauncherHelper.java:692)
The only solution I found was to exclude the signature files from the final jar. This works fine on OpenJDK JRE, but the Oracle JRE requires security providers (such as Bouncy Castle's) to be signed, so excluding the signature files results in
java.lang.SecurityException: JCE cannot authenticate the provider BC
at java.base/javax.crypto.JceSecurity.getInstance(JceSecurity.java:150)
at java.base/javax.crypto.KeyAgreement.getInstance(KeyAgreement.java:280)
at ... (my dependency's classes)
Caused by: java.util.jar.JarException: The JCE Provider file:/app/simple-usecase-0.0.6.jar is not signed.
at javax.crypto.JarVerifier.verifySingleJar(JarVerifier.java:440) ~[?:?]
at javax.crypto.JarVerifier.verifyJars(JarVerifier.java:319) ~[?:?]
at javax.crypto.JarVerifier.verify(JarVerifier.java:263) ~[?:?]
at javax.crypto.ProviderVerifier.verify(ProviderVerifier.java:130) ~[?:?]
at javax.crypto.JceSecurity.verifyProvider(JceSecurity.java:196) ~[?:?]
at javax.crypto.JceSecurity$2.apply(JceSecurity.java:222) ~[?:?]
at javax.crypto.JceSecurity$2.apply(JceSecurity.java:211) ~[?:?]
at java.util.concurrent.ConcurrentHashMap.computeIfAbsent(ConcurrentHashMap.java:1708) ~[?:?]
at javax.crypto.JceSecurity.getVerificationResult(JceSecurity.java:211) ~[?:?]
at javax.crypto.JceSecurity.getInstance(JceSecurity.java:146) ~[?:?]
at javax.crypto.KeyAgreement.getInstance(KeyAgreement.java:280) ~[?:?]
at ... (my dependency's classes again)
whenever it's called from the code.
I need to compile it to a single jar that can run on the following JRE (from Oracle):
java 21.0.3 2024-04-16 LTS
Java(TM) SE Runtime Environment (build 21.0.3+7-LTS-152)
Java HotSpot(TM) 64-Bit Server VM (build 21.0.3+7-LTS-152, mixed mode, sharing)
I have tried using Maven Shade plugin and excluding the signature files:
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-shade-plugin</artifactId>
<version>3.5.3</version>
<executions>
<execution>
<phase>package</phase>
<goals>
<goal>shade</goal>
</goals>
<configuration>
<minimizeJar>false</minimizeJar>
<createDependencyReducedPom>true</createDependencyReducedPom>
<dependencyReducedPomLocation>
${java.io.tmpdir}/dependency-reduced-pom.xml
</dependencyReducedPomLocation>
<relocations>
<relocation>
<pattern>com.acme.coyote</pattern>
<shadedPattern>hidden.coyote</shadedPattern>
</relocation>
</relocations>
<transformers>
<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
<mainClass>Main</mainClass>
</transformer>
</transformers>
<filters>
<filter>
<artifact>*:*</artifact>
<excludes>
<exclude>META-INF/*.SF</exclude>
<exclude>META-INF/*.DSA</exclude>
<exclude>META-INF/*.RSA</exclude>
</excludes>
</filter>
</filters>
</configuration>
</execution>
</executions>
</plugin>
I have also tried just using Maven Assembly single:
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-assembly-plugin</artifactId>
<version>3.7.1</version>
<configuration>
<archive>
<manifest>
<mainClass>Main</mainClass>
</manifest>
</archive>
<descriptorRefs>
<descriptorRef>jar-with-dependencies</descriptorRef>
</descriptorRefs>
</configuration>
<executions>
<execution>
<id>make-assembly</id>
<phase>package</phase>
<goals>
<goal>single</goal>
</goals>
</execution>
</executions>
</plugin>
Both of the above work when running with OpenJDK, but not with Oracle.
As a last resource, I have also tried excluding all Bouncy Castle dependencies from the shaded jar by adding this to the Maven Shade configuration:
<artifactSet>
<excludes>
<exclude>org.bouncycastle</exclude>
</excludes>
</artifactSet>
and then adding the Bouncy Castle jars manually with -cp
, but then the class loader didn't find them. (As expected, this also failed on OpenJDK)
Is there any way to solve this?
I'm compiling with OpenJDK 21 for target version 21 and these are the specific Bouncy Castle dependencies (this isn't directly on my project, but in one of its dependencies):
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk18on</artifactId>
<version>1.78.1</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcutil-jdk18on</artifactId>
<version>1.78.1</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk18on</artifactId>
<version>1.78.1</version>
</dependency>
</dependencies>
java -jar jarfile
it ignores any-cp/classpath
argument provided, and also any CLASSPATH envvar; you can only specify a classpath (beyond the jar itself) using a field in the jar manifest, which I know how to do by hand but not in maven. Or you can use the more basic syntaxjava -cp myjar:bcprov:etc mainclassname [args]
Of course either uses more than one jar, contrary to your requirement/preference(?). (FWIW the Oracle-was-Sun-but-not-OpenJDK requirement to sign cryptoproviders has been there forever and is not version specific.)mvn dependency:build-classpath