Thiết kế website giá rẻ

Question

I’m making a project that has dependencies (also made by me) that themselves depend on Bouncy Castle, which includes signature files for its jar, and if these are present in the shaded jar, the JVM sees the jar is not valid for those signatures and refuses to run it:

Error: A JNI error has occurred, please check your installation and try again
Exception in thread "main" java.lang.SecurityException: Invalid signature file digest for Manifest main attributes
    at java.base/sun.security.util.SignatureFileVerifier.processImpl(SignatureFileVerifier.java:340)
    at java.base/sun.security.util.SignatureFileVerifier.process(SignatureFileVerifier.java:282)
    at java.base/java.util.jar.JarVerifier.processEntry(JarVerifier.java:320)
    at java.base/java.util.jar.JarVerifier.update(JarVerifier.java:232)
    at java.base/java.util.jar.JarFile.initializeVerifier(JarFile.java:760)
    at java.base/java.util.jar.JarFile.getInputStream(JarFile.java:856)
    at java.base/jdk.internal.loader.URLClassPath$JarLoader$2.getInputStream(URLClassPath.java:848)
    at java.base/jdk.internal.loader.Resource.cachedInputStream(Resource.java:77)
    at java.base/jdk.internal.loader.Resource.getByteBuffer(Resource.java:163)
    at java.base/jdk.internal.loader.BuiltinClassLoader.defineClass(BuiltinClassLoader.java:853)
    at java.base/jdk.internal.loader.BuiltinClassLoader.findClassOnClassPathOrNull(BuiltinClassLoader.java:760)
    at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:681)
    at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:639)
    at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:526)
    at java.base/java.lang.Class.forName0(Native Method)
    at java.base/java.lang.Class.forName(Class.java:534)
    at java.base/java.lang.Class.forName(Class.java:513)
    at java.base/sun.launcher.LauncherHelper.loadMainClass(LauncherHelper.java:797)
    at java.base/sun.launcher.LauncherHelper.checkAndLoadMain(LauncherHelper.java:692)

The only solution I found was to exclude the signature files from the final jar. This works fine on OpenJDK JRE, but the Oracle JRE requires security providers (such as Bouncy Castle’s) to be signed, so excluding the signature files results in

java.lang.SecurityException: JCE cannot authenticate the provider BC
    at java.base/javax.crypto.JceSecurity.getInstance(JceSecurity.java:150)
    at java.base/javax.crypto.KeyAgreement.getInstance(KeyAgreement.java:280)
    at ... (my dependency's classes)
Caused by: java.util.jar.JarException: The JCE Provider file:/app/simple-usecase-0.0.6.jar is not signed.
    at javax.crypto.JarVerifier.verifySingleJar(JarVerifier.java:440) ~[?:?]
    at javax.crypto.JarVerifier.verifyJars(JarVerifier.java:319) ~[?:?]
    at javax.crypto.JarVerifier.verify(JarVerifier.java:263) ~[?:?]
    at javax.crypto.ProviderVerifier.verify(ProviderVerifier.java:130) ~[?:?]
    at javax.crypto.JceSecurity.verifyProvider(JceSecurity.java:196) ~[?:?]
    at javax.crypto.JceSecurity$2.apply(JceSecurity.java:222) ~[?:?]
    at javax.crypto.JceSecurity$2.apply(JceSecurity.java:211) ~[?:?]
    at java.util.concurrent.ConcurrentHashMap.computeIfAbsent(ConcurrentHashMap.java:1708) ~[?:?]
    at javax.crypto.JceSecurity.getVerificationResult(JceSecurity.java:211) ~[?:?]
    at javax.crypto.JceSecurity.getInstance(JceSecurity.java:146) ~[?:?]
    at javax.crypto.KeyAgreement.getInstance(KeyAgreement.java:280) ~[?:?]
    at ... (my dependency's classes again)

whenever it’s called from the code.

I need to compile it to a single jar that can run on the following JRE (from Oracle):

java 21.0.3 2024-04-16 LTS
Java(TM) SE Runtime Environment (build 21.0.3+7-LTS-152)
Java HotSpot(TM) 64-Bit Server VM (build 21.0.3+7-LTS-152, mixed mode, sharing)

I have tried using Maven Shade plugin and excluding the signature files:

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-shade-plugin</artifactId>
    <version>3.5.3</version>
    <executions>
        <execution>
            <phase>package</phase>
            <goals>
                <goal>shade</goal>
                </goals>
            <configuration>
                <minimizeJar>false</minimizeJar>
                <createDependencyReducedPom>true</createDependencyReducedPom>
                <dependencyReducedPomLocation>
                    ${java.io.tmpdir}/dependency-reduced-pom.xml
                    </dependencyReducedPomLocation>
                <relocations>
                    <relocation>
                        <pattern>com.acme.coyote</pattern>
                        <shadedPattern>hidden.coyote</shadedPattern>
                        </relocation>
                    </relocations>
                <transformers>
                    <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                        <mainClass>Main</mainClass>
                        </transformer>
                    </transformers>
                <filters>
                    <filter>
                        <artifact>*:*</artifact>
                        <excludes>
                            <exclude>META-INF/*.SF</exclude>
                            <exclude>META-INF/*.DSA</exclude>
                            <exclude>META-INF/*.RSA</exclude>
                            </excludes>
                        </filter>
                    </filters>
                </configuration>
            </execution>
        </executions>
    </plugin>

I have also tried just using Maven Assembly single:

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-assembly-plugin</artifactId>
    <version>3.7.1</version>
    <configuration>
        <archive>
            <manifest>
                <mainClass>Main</mainClass>
                </manifest>
            </archive>
        <descriptorRefs>
            <descriptorRef>jar-with-dependencies</descriptorRef>
            </descriptorRefs>
        </configuration>
    <executions>
        <execution>
            <id>make-assembly</id>
            <phase>package</phase>
            <goals>
                <goal>single</goal>
                </goals>
            </execution>
        </executions>
    </plugin>

Both of the above work when running with OpenJDK, but not with Oracle.

As a last resource, I have also tried excluding all Bouncy Castle dependencies from the shaded jar by adding this to the Maven Shade configuration:

<artifactSet>
    <excludes>
        <exclude>org.bouncycastle</exclude>
        </excludes>
    </artifactSet>

and then adding the Bouncy Castle jars manually with -cp, but then the class loader didn’t find them. (As expected, this also failed on OpenJDK)

Is there any way to solve this?

I’m compiling with OpenJDK 21 for target version 21 and these are the specific Bouncy Castle dependencies (this isn’t directly on my project, but in one of its dependencies):

<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcprov-jdk18on</artifactId>
    <version>1.78.1</version>
    </dependency>
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcutil-jdk18on</artifactId>
    <version>1.78.1</version>
    </dependency>
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk18on</artifactId>
    <version>1.78.1</version>
    </dependency>
    </dependencies>

Thiết kế website giá rẻ

Danh mục

Create single jar for a project with Bouncy Castle dependencies that can run on Oracle JRE