java.lang.SecurityException: no manifest section for signature file entry

Just a short post to document a very frustrating problem I wrestled with for a while today.

I’m in the process of converting some older Ant based projects to Maven (yes, I know, Gradle is the rage now). One of these projects is packaged as an uber jar file — meaning ALL its dependencies are just packaged right into one giant file. Thinking I had things just about wrapped up, I ran my utility to be greeted by ….

Exception in thread "main" java.lang.SecurityException: no manifest section for signature file entry 
org/bouncycastle/cms/CMSSignedDataStreamGenerator$TeeOutputStream.class
	at sun.security.util.SignatureFileVerifier.verifySection(SignatureFileVerifier.java:380)
	at sun.security.util.SignatureFileVerifier.processImpl(SignatureFileVerifier.java:231)
	at sun.security.util.SignatureFileVerifier.process(SignatureFileVerifier.java:176)
	at java.util.jar.JarVerifier.processEntry(JarVerifier.java:288)
	at java.util.jar.JarVerifier.update(JarVerifier.java:199)
	at java.util.jar.JarFile.initializeVerifier(JarFile.java:323)
	at java.util.jar.JarFile.getInputStream(JarFile.java:388)
	at sun.misc.URLClassPath$JarLoader$2.getInputStream(URLClassPath.java:692)
	at sun.misc.Resource.cachedInputStream(Resource.java:61)
	at sun.misc.Resource.getByteBuffer(Resource.java:144)
	at java.net.URLClassLoader.defineClass(URLClassLoader.java:256)
	at java.net.URLClassLoader.access$000(URLClassLoader.java:58)
	at java.net.URLClassLoader$1.run(URLClassLoader.java:197)
	at java.security.AccessController.doPrivileged(Native Method)
	at java.net.URLClassLoader.findClass(URLClassLoader.java:190)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
	at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:301)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:247)

The issue turned out to be that I was repackaging a signed jar file. There are a couple of ways around this that I know of. One option is to simply not repackage the signed jar, but I really didn’t want to deal with external dependencies. Another option is to exclude the signature file entries from the repackaged jar. Using the maven-shade-plugin, this can be done like so:

<plugin>
   <groupId>org.apache.maven.plugins</groupId>
   <artifactId>maven-shade-plugin</artifactId>
   <executions>
      <execution>
         <phase>package</phase>
            <goals>
               <goal>shade</goal>
            </goals>
      </execution>
   </executions>
   <configuration>
      <finalName>${project.artifactId}-${project.version}-uber</finalName>
      <filters>
         <filter>
            <artifact>*:*</artifact>
               <excludes>
                  <exclude>META-INF/*.SF</exclude>
                  <exclude>META-INF/*.DSA</exclude>
                  <exclude>META-INF/*.RSA</exclude>
               </excludes>
            </filter>
         </filters>
   </configuration>
</plugin>

And voilà! Now we’ve repackaged the contents of a signed jar into an unsigned one. Whether that’s a good idea or not depends on what you’re doing, but for my purposes it was just fine.



11 views shared on this article. Join in...

  1. John says:

    Nice one! Just ran into this exact problem using the shade plugin. A quick google later and you solved something that probably would have had me scratching my head for days!

  2. David says:

    Thanks for putitng this up, ran into the same problem.

  3. Adam says:

    That’s what I’ve needed. Thanks.

  4. David Marquez says:

    I was having this problem with a dependency of a hadoop dependency and this solved it. You saved my day. Thank you!

  5. Odd Erik says:

    Exactly the solution I needed today. Thanks a lot.

  6. Nikolay Cheltsov says:

    Glad to find this post. The exact problem with me. Long live google! 🙂

  7. Rafael Fogel says:

    Thanks man! I was facing the same error.

  8. Marko_07 says:

    Thanks dude!

  9. Thiago says:

    I’m using a JAVAFX MAVEN project and not working. Any another sugestions?

  10. Runqi Yang says:

    Thanks a lot!! It saves me a lot of time. Thumbs up!

Leave a Reply

Your email address will not be published. Required fields are marked *

Comment

You may use these tags : <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>