java.lang.SecurityException: no manifest section for signature file entry

Just a short post to document a very frustrating problem I wrestled with for a while today.

I’m in the process of converting some older Ant based projects to Maven (yes, I know, Gradle is the rage now). One of these projects is packaged as an uber jar file — meaning ALL its dependencies are just packaged right into one giant file. Thinking I had things just about wrapped up, I ran my utility to be greeted by ….

Exception in thread "main" java.lang.SecurityException: no manifest section for signature file entry 
org/bouncycastle/cms/CMSSignedDataStreamGenerator$TeeOutputStream.class
	at sun.security.util.SignatureFileVerifier.verifySection(SignatureFileVerifier.java:380)
	at sun.security.util.SignatureFileVerifier.processImpl(SignatureFileVerifier.java:231)
	at sun.security.util.SignatureFileVerifier.process(SignatureFileVerifier.java:176)
	at java.util.jar.JarVerifier.processEntry(JarVerifier.java:288)
	at java.util.jar.JarVerifier.update(JarVerifier.java:199)
	at java.util.jar.JarFile.initializeVerifier(JarFile.java:323)
	at java.util.jar.JarFile.getInputStream(JarFile.java:388)
	at sun.misc.URLClassPath$JarLoader$2.getInputStream(URLClassPath.java:692)
	at sun.misc.Resource.cachedInputStream(Resource.java:61)
	at sun.misc.Resource.getByteBuffer(Resource.java:144)
	at java.net.URLClassLoader.defineClass(URLClassLoader.java:256)
	at java.net.URLClassLoader.access$000(URLClassLoader.java:58)
	at java.net.URLClassLoader$1.run(URLClassLoader.java:197)
	at java.security.AccessController.doPrivileged(Native Method)
	at java.net.URLClassLoader.findClass(URLClassLoader.java:190)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
	at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:301)
	at java.lang.ClassLoader.loadClass(ClassLoader.java:247)

The issue turned out to be that I was repackaging a signed jar file. There are a couple of ways around this that I know of. One option is to simply not repackage the signed jar, but I really didn’t want to deal with external dependencies. Another option is to exclude the signature file entries from the repackaged jar. Using the maven-shade-plugin, this can be done like so:

<plugin>
   <groupId>org.apache.maven.plugins</groupId>
   <artifactId>maven-shade-plugin</artifactId>
   <executions>
      <execution>
         <phase>package</phase>
            <goals>
               <goal>shade</goal>
            </goals>
      </execution>
   </executions>
   <configuration>
      <finalName>${project.artifactId}-${project.version}-uber</finalName>
      <filters>
         <filter>
            <artifact>*:*</artifact>
               <excludes>
                  <exclude>META-INF/*.SF</exclude>
                  <exclude>META-INF/*.DSA</exclude>
                  <exclude>META-INF/*.RSA</exclude>
               </excludes>
            </filter>
         </filters>
   </configuration>
</plugin>

And voilà! Now we’ve repackaged the contents of a signed jar into an unsigned one. Whether that’s a good idea or not depends on what you’re doing, but for my purposes it was just fine.

This entry was posted in Software Development. Bookmark the permalink.

11 Responses to java.lang.SecurityException: no manifest section for signature file entry

  1. John says:

    Nice one! Just ran into this exact problem using the shade plugin. A quick google later and you solved something that probably would have had me scratching my head for days!

  2. David says:

    Thanks for putitng this up, ran into the same problem.

  3. Adam says:

    That’s what I’ve needed. Thanks.

  4. David Marquez says:

    I was having this problem with a dependency of a hadoop dependency and this solved it. You saved my day. Thank you!

  5. Odd Erik says:

    Exactly the solution I needed today. Thanks a lot.

  6. Nikolay Cheltsov says:

    Glad to find this post. The exact problem with me. Long live google! 🙂

  7. Rafael Fogel says:

    Thanks man! I was facing the same error.

  8. Marko_07 says:

    Thanks dude!

  9. Thiago says:

    I’m using a JAVAFX MAVEN project and not working. Any another sugestions?

  10. Runqi Yang says:

    Thanks a lot!! It saves me a lot of time. Thumbs up!

Comments are closed.