Fixing the SecurityException: Invalid Signature File Digest for Manifest Main Attributes in Fat Jars
TL;DR When building a fat JAR, signature files from individual JARs cannot be verified against the merged JAR, causing a SecurityException. Exclude signature files under META-INF using the maven-shade-plugin to resolve the issue.
The Problem
Recently I encountered an error when trying to run a fat jar:
1 | Exception in thread "main" java.lang.SecurityException: Invalid signature file digest for Manifest main attributes |
Root Cause: Signature File Conflict
After some investigation, I found it’s related to jar signing. For details on signing, you can refer to: http://www.cnblogs.com/jackofhearts/p/jar_signing.html
Some jar packages contain a .SF file in META-INF, which includes the hashes of the class files and resource files in the original jar package, used for verifying file integrity and other validations.
The Problem Caused by Maven Shade
However, when building a fat jar, we combine many jar packages into one. This means the fat jar ends up containing signature files from each individual jar, but they obviously cannot be validated against the final fat jar.
Solution
The solution is to remove all signature files during packaging. If you’re using Maven, you can use the shade plugin:
Maven Configuration Example
1 | <plugin> |
Prevention Measures
Source: https://lichuanyang.top/en/posts/2478/
All articles on this blog are licensed under CC BY-NC-SA 4.0 unless otherwise stated.
微信
Related Articles
2017-04-01
Embedding Hawtio Monitoring in a Standalone Java Application
Hawtio (hawt.io) is an open-source monitoring system that provides multiple startup methods. It can run as a standalone JAR or WAR package and remotely connect to other applications for monitoring, or it can be directly embedded into our own applications. This article introduces how to embed Hawtio in a standalone Java application, corresponding to the official documentation (http://hawt.io/getstarted/index.html) section “Using hawtio inside a stand alone Java application”. However, that se...
2017-05-14
Building Executable JAR Packages with Maven Shade Plugin
What Is a Fat JarEclipse has a feature called “Export Runnable JAR File” that packages a project along with all its dependencies into a Fat JAR, with a specified Main class, so you can run the code directly using java jar xxx.jar. Maven Shade Plugin ConfigurationHowever, what if you’re not using Eclipse? Actually, with the help of Maven, we can easily achieve the same functionality. Maven provides a Shade Plugin that can be used to build Fat JARs, and it also supports specifying the Main cl...
2017-06-05
[Translation] Some Experiences Writing Benchmarks in Java
Why Benchmark Testing is NeededSometimes we need to write some simple performance test code. I happened to come across an experience-based post on Stack Overflow: https://stackoverflow.com/questions/504103/how-do-i-write-a-correct-micro-benchmark-in-java — how to write benchmarks to minimize environmental influence. Here’s my translation: Writing Reliable BenchmarksTips from a Java HotSpot author on writing microbenchmarks: Rule 0: Read good papers on the JVM and microbenchmarks. For example,...
2017-04-10
Comparing Java Lists Without Implementing equals
Problem StatementIn Java, there are several ways to compare whether two Lists have the same values regardless of order, such as sorting followed by using equals, or executing containsAll in both directions, etc. All of these methods require us to implement the equals and hashCode methods for the element classes in the list. However, there are special cases where it’s not convenient for us to implement the equals method of a class — for example, when it comes from an ancient third-party JAR pa...
2015-08-08
About Apache Camel's Message Forwarding Efficiency
Test ScenarioThe company uses ActiveMQ and Camel for message distribution. Previously, the data volume wasn’t very large, so we never really considered efficiency issues, and the research into Camel’s working principles wasn’t deep. However, recently, as the business volume increased, Camel’s efficiency has gradually become a bottleneck, so I got a general understanding of Camel’s working principles based on logs. Although Camel is embedded into ActiveMQ, during the working process, Camel and...
2017-03-02
Java Serialization Performance Comparison: kryo/protobuf/protostuff vs Json
Why Compare Serialization SolutionsFor serializing a Java object, I wanted to test the differences in time and space performance between using JSON and using general-purpose serialization tools. For JSON, I chose fastjson. For serialization tools, I used protostuff and kryo. Why not protobuf? Because for an existing Java class with hundreds of properties, creating a matching proto file feels somewhat inhumane. Protostuff is an improved version of protobuf — it can directly serialize a Java ...
Comments
Recent Posts
