0

I'm making a project that has dependencies (also made by me) that themselves depend on Bouncy Castle, which includes signature files for its jar, and if these are present in the shaded jar, the JVM sees the jar is not valid for those signatures and refuses to run it:

Error: A JNI error has occurred, please check your installation and try again
Exception in thread "main" java.lang.SecurityException: Invalid signature file digest for Manifest main attributes
    at java.base/sun.security.util.SignatureFileVerifier.processImpl(SignatureFileVerifier.java:340)
    at java.base/sun.security.util.SignatureFileVerifier.process(SignatureFileVerifier.java:282)
    at java.base/java.util.jar.JarVerifier.processEntry(JarVerifier.java:320)
    at java.base/java.util.jar.JarVerifier.update(JarVerifier.java:232)
    at java.base/java.util.jar.JarFile.initializeVerifier(JarFile.java:760)
    at java.base/java.util.jar.JarFile.getInputStream(JarFile.java:856)
    at java.base/jdk.internal.loader.URLClassPath$JarLoader$2.getInputStream(URLClassPath.java:848)
    at java.base/jdk.internal.loader.Resource.cachedInputStream(Resource.java:77)
    at java.base/jdk.internal.loader.Resource.getByteBuffer(Resource.java:163)
    at java.base/jdk.internal.loader.BuiltinClassLoader.defineClass(BuiltinClassLoader.java:853)
    at java.base/jdk.internal.loader.BuiltinClassLoader.findClassOnClassPathOrNull(BuiltinClassLoader.java:760)
    at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:681)
    at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:639)
    at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)
    at java.base/java.lang.Class.forName0(Native Method)
    at java.base/java.lang.Class.forName(Class.java:534)
    at java.base/java.lang.Class.forName(Class.java:513)
    at java.base/sun.launcher.LauncherHelper.loadMainClass(LauncherHelper.java:797)
    at java.base/sun.launcher.LauncherHelper.checkAndLoadMain(LauncherHelper.java:692)

The only solution I found was to exclude the signature files from the final jar. This works fine on OpenJDK JRE, but the Oracle JRE requires security providers (such as Bouncy Castle's) to be signed, so excluding the signature files results in

java.lang.SecurityException: JCE cannot authenticate the provider BC
    at java.base/javax.crypto.JceSecurity.getInstance(JceSecurity.java:150)
    at java.base/javax.crypto.KeyAgreement.getInstance(KeyAgreement.java:280)
    at ... (my dependency's classes)
Caused by: java.util.jar.JarException: The JCE Provider file:/app/simple-usecase-0.0.6.jar is not signed.
    at javax.crypto.JarVerifier.verifySingleJar(JarVerifier.java:440) ~[?:?]
    at javax.crypto.JarVerifier.verifyJars(JarVerifier.java:319) ~[?:?]
    at javax.crypto.JarVerifier.verify(JarVerifier.java:263) ~[?:?]
    at javax.crypto.ProviderVerifier.verify(ProviderVerifier.java:130) ~[?:?]
    at javax.crypto.JceSecurity.verifyProvider(JceSecurity.java:196) ~[?:?]
    at javax.crypto.JceSecurity$2.apply(JceSecurity.java:222) ~[?:?]
    at javax.crypto.JceSecurity$2.apply(JceSecurity.java:211) ~[?:?]
    at java.util.concurrent.ConcurrentHashMap.computeIfAbsent(ConcurrentHashMap.java:1708) ~[?:?]
    at javax.crypto.JceSecurity.getVerificationResult(JceSecurity.java:211) ~[?:?]
    at javax.crypto.JceSecurity.getInstance(JceSecurity.java:146) ~[?:?]
    at javax.crypto.KeyAgreement.getInstance(KeyAgreement.java:280) ~[?:?]
    at ... (my dependency's classes again)

whenever it's called from the code.

I need to compile it to a single jar that can run on the following JRE (from Oracle):

java 21.0.3 2024-04-16 LTS
Java(TM) SE Runtime Environment (build 21.0.3+7-LTS-152)
Java HotSpot(TM) 64-Bit Server VM (build 21.0.3+7-LTS-152, mixed mode, sharing)

I have tried using Maven Shade plugin and excluding the signature files:

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-shade-plugin</artifactId>
    <version>3.5.3</version>
    <executions>
        <execution>
            <phase>package</phase>
            <goals>
                <goal>shade</goal>
                </goals>
            <configuration>
                <minimizeJar>false</minimizeJar>
                <createDependencyReducedPom>true</createDependencyReducedPom>
                <dependencyReducedPomLocation>
                    ${java.io.tmpdir}/dependency-reduced-pom.xml
                    </dependencyReducedPomLocation>
                <relocations>
                    <relocation>
                        <pattern>com.acme.coyote</pattern>
                        <shadedPattern>hidden.coyote</shadedPattern>
                        </relocation>
                    </relocations>
                <transformers>
                    <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                        <mainClass>Main</mainClass>
                        </transformer>
                    </transformers>
                <filters>
                    <filter>
                        <artifact>*:*</artifact>
                        <excludes>
                            <exclude>META-INF/*.SF</exclude>
                            <exclude>META-INF/*.DSA</exclude>
                            <exclude>META-INF/*.RSA</exclude>
                            </excludes>
                        </filter>
                    </filters>
                </configuration>
            </execution>
        </executions>
    </plugin>

I have also tried just using Maven Assembly single:

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-assembly-plugin</artifactId>
    <version>3.7.1</version>
    <configuration>
        <archive>
            <manifest>
                <mainClass>Main</mainClass>
                </manifest>
            </archive>
        <descriptorRefs>
            <descriptorRef>jar-with-dependencies</descriptorRef>
            </descriptorRefs>
        </configuration>
    <executions>
        <execution>
            <id>make-assembly</id>
            <phase>package</phase>
            <goals>
                <goal>single</goal>
                </goals>
            </execution>
        </executions>
    </plugin>

Both of the above work when running with OpenJDK, but not with Oracle.

As a last resource, I have also tried excluding all Bouncy Castle dependencies from the shaded jar by adding this to the Maven Shade configuration:

<artifactSet>
    <excludes>
        <exclude>org.bouncycastle</exclude>
        </excludes>
    </artifactSet>

and then adding the Bouncy Castle jars manually with -cp, but then the class loader didn't find them. (As expected, this also failed on OpenJDK)

Is there any way to solve this?

I'm compiling with OpenJDK 21 for target version 21 and these are the specific Bouncy Castle dependencies (this isn't directly on my project, but in one of its dependencies):

<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcprov-jdk18on</artifactId>
    <version>1.78.1</version>
    </dependency>
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcutil-jdk18on</artifactId>
    <version>1.78.1</version>
    </dependency>
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk18on</artifactId>
    <version>1.78.1</version>
    </dependency>
    </dependencies>
2
  • If you run a jar using java -jar jarfile it ignores any -cp/classpath argument provided, and also any CLASSPATH envvar; you can only specify a classpath (beyond the jar itself) using a field in the jar manifest, which I know how to do by hand but not in maven. Or you can use the more basic syntax java -cp myjar:bcprov:etc mainclassname [args] Of course either uses more than one jar, contrary to your requirement/preference(?). (FWIW the Oracle-was-Sun-but-not-OpenJDK requirement to sign cryptoproviders has been there forever and is not version specific.) Commented Jun 29 at 19:59
  • Yes, you're out of luck, unless of course you're in possession of BC's private key ;) You might as well not fat jar it at all if you have to one jar not included. You can make life easier to figure out the classpath with mvn dependency:build-classpath
    – g00se
    Commented Jun 29 at 20:35

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.