Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(4.x.x) Fix Java10 signing problem #1966

Merged
merged 1 commit into from Jun 25, 2018

Conversation

dizzzz
Copy link
Member

@dizzzz dizzzz commented Jun 24, 2018

Fix java10 java.lang.SecurityException: class "javax.annotation.Nullable"'s signer information does not match signer information of other classes in the same package"

HTTP ERROR 500

Problem accessing /exist/apps/dashboard/index.html. Reason:

    Server Error
Caused by:

javax.servlet.ServletException: org.eclipse.jetty.servlet.ServletHolder$1: java.lang.SecurityException: class "javax.annotation.Nullable"'s signer information does not match signer information of other classes in the same package
	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:146)
	at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:724)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.Server.handle(Server.java:531)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:352)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:260)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:281)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:333)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:310)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:168)
	at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.produce(EatWhatYouKill.java:132)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:760)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:678)
	at java.base/java.lang.Thread.run(Thread.java:844)
Caused by: org.eclipse.jetty.servlet.ServletHolder$1: java.lang.SecurityException: class "javax.annotation.Nullable"'s signer information does not match signer information of other classes in the same package
	at org.eclipse.jetty.servlet.ServletHolder.makeUnavailable(ServletHolder.java:629)
	at org.eclipse.jetty.servlet.ServletHolder.initServlet(ServletHolder.java:681)
	at org.eclipse.jetty.servlet.ServletHolder.getServlet(ServletHolder.java:519)
	at org.eclipse.jetty.servlet.ServletHolder.prepare(ServletHolder.java:803)
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:530)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:146)
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:524)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:257)
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:255)
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1253)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:203)
	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)
	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:201)
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1155)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:144)
	at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:219)
	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:126)
	at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:674)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.Server.handle(Server.java:531)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:352)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:260)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:281)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118)
	... 3 more
Caused by: java.lang.SecurityException: class "javax.annotation.Nullable"'s signer information does not match signer information of other classes in the same package
	at java.base/java.lang.ClassLoader.checkCerts(ClassLoader.java:1143)
	at java.base/java.lang.ClassLoader.preDefineClass(ClassLoader.java:898)
	at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1007)
	at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:174)
	at java.base/java.net.URLClassLoader.defineClass(URLClassLoader.java:545)
	at java.base/java.net.URLClassLoader.access$100(URLClassLoader.java:83)
	at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:453)
	at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:447)
	at java.base/java.security.AccessController.doPrivileged(Native Method)
	at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:446)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:566)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:499)
	at java.base/java.lang.Class.forName0(Native Method)
	at java.base/java.lang.Class.forName(Class.java:374)
	at java.base/sun.reflect.generics.factory.CoreReflectionFactory.makeNamedType(CoreReflectionFactory.java:114)
	at java.base/sun.reflect.generics.visitor.Reifier.visitClassTypeSignature(Reifier.java:125)
	at java.base/sun.reflect.generics.tree.ClassTypeSignature.accept(ClassTypeSignature.java:49)
	at java.base/sun.reflect.annotation.AnnotationParser.parseSig(AnnotationParser.java:439)
	at java.base/sun.reflect.annotation.AnnotationParser.parseAnnotation2(AnnotationParser.java:241)
	at java.base/sun.reflect.annotation.AnnotationParser.parseAnnotations2(AnnotationParser.java:120)
	at java.base/sun.reflect.annotation.AnnotationParser.parseAnnotations(AnnotationParser.java:72)
	at java.base/java.lang.reflect.Executable.declaredAnnotations(Executable.java:605)
	at java.base/java.lang.reflect.Executable.declaredAnnotations(Executable.java:603)
	at java.base/java.lang.reflect.Executable.getAnnotation(Executable.java:573)
	at java.base/java.lang.reflect.Method.getAnnotation(Method.java:693)
	at org.eclipse.jetty.annotations.ResourceAnnotationHandler.handleMethod(ResourceAnnotationHandler.java:226)
	at org.eclipse.jetty.annotations.ResourceAnnotationHandler.doHandle(ResourceAnnotationHandler.java:73)
	at org.eclipse.jetty.annotations.AnnotationIntrospector$AbstractIntrospectableAnnotationHandler.handle(AnnotationIntrospector.java:72)
	at org.eclipse.jetty.annotations.AnnotationIntrospector.introspect(AnnotationIntrospector.java:97)
	at org.eclipse.jetty.annotations.AnnotationDecorator.introspect(AnnotationDecorator.java:61)
	at org.eclipse.jetty.annotations.AnnotationDecorator.decorate(AnnotationDecorator.java:67)
	at org.eclipse.jetty.util.DecoratedObjectFactory.decorate(DecoratedObjectFactory.java:79)
	at org.eclipse.jetty.servlet.ServletContextHandler$Context.createServlet(ServletContextHandler.java:1373)
	at org.eclipse.jetty.servlet.ServletHolder.newInstance(ServletHolder.java:1297)
	at org.eclipse.jetty.servlet.ServletHolder.initServlet(ServletHolder.java:647)
	... 29 more
Caused by:

org.eclipse.jetty.servlet.ServletHolder$1: java.lang.SecurityException: class "javax.annotation.Nullable"'s signer information does not match signer information of other classes in the same package
	at org.eclipse.jetty.servlet.ServletHolder.makeUnavailable(ServletHolder.java:629)
	at org.eclipse.jetty.servlet.ServletHolder.initServlet(ServletHolder.java:681)
	at org.eclipse.jetty.servlet.ServletHolder.getServlet(ServletHolder.java:519)
	at org.eclipse.jetty.servlet.ServletHolder.prepare(ServletHolder.java:803)
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:530)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:146)
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:524)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:257)
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:255)
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1253)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:203)
	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)
	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:201)
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1155)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:144)
	at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:219)
	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:126)
	at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:674)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.Server.handle(Server.java:531)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:352)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:260)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:281)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:760)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:678)
	at java.base/java.lang.Thread.run(Thread.java:844)
Caused by: java.lang.SecurityException: class "javax.annotation.Nullable"'s signer information does not match signer information of other classes in the same package
	at java.base/java.lang.ClassLoader.checkCerts(ClassLoader.java:1143)
	at java.base/java.lang.ClassLoader.preDefineClass(ClassLoader.java:898)
	at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1007)
	at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:174)
	at java.base/java.net.URLClassLoader.defineClass(URLClassLoader.java:545)
	at java.base/java.net.URLClassLoader.access$100(URLClassLoader.java:83)
	at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:453)
	at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:447)
	at java.base/java.security.AccessController.doPrivileged(Native Method)
	at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:446)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:566)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:499)
	at java.base/java.lang.Class.forName0(Native Method)
	at java.base/java.lang.Class.forName(Class.java:374)
	at java.base/sun.reflect.generics.factory.CoreReflectionFactory.makeNamedType(CoreReflectionFactory.java:114)
	at java.base/sun.reflect.generics.visitor.Reifier.visitClassTypeSignature(Reifier.java:125)
	at java.base/sun.reflect.generics.tree.ClassTypeSignature.accept(ClassTypeSignature.java:49)
	at java.base/sun.reflect.annotation.AnnotationParser.parseSig(AnnotationParser.java:439)
	at java.base/sun.reflect.annotation.AnnotationParser.parseAnnotation2(AnnotationParser.java:241)
	at java.base/sun.reflect.annotation.AnnotationParser.parseAnnotations2(AnnotationParser.java:120)
	at java.base/sun.reflect.annotation.AnnotationParser.parseAnnotations(AnnotationParser.java:72)
	at java.base/java.lang.reflect.Executable.declaredAnnotations(Executable.java:605)
	at java.base/java.lang.reflect.Executable.declaredAnnotations(Executable.java:603)
	at java.base/java.lang.reflect.Executable.getAnnotation(Executable.java:573)
	at java.base/java.lang.reflect.Method.getAnnotation(Method.java:693)
	at org.eclipse.jetty.annotations.ResourceAnnotationHandler.handleMethod(ResourceAnnotationHandler.java:226)
	at org.eclipse.jetty.annotations.ResourceAnnotationHandler.doHandle(ResourceAnnotationHandler.java:73)
	at org.eclipse.jetty.annotations.AnnotationIntrospector$AbstractIntrospectableAnnotationHandler.handle(AnnotationIntrospector.java:72)
	at org.eclipse.jetty.annotations.AnnotationIntrospector.introspect(AnnotationIntrospector.java:97)
	at org.eclipse.jetty.annotations.AnnotationDecorator.introspect(AnnotationDecorator.java:61)
	at org.eclipse.jetty.annotations.AnnotationDecorator.decorate(AnnotationDecorator.java:67)
	at org.eclipse.jetty.util.DecoratedObjectFactory.decorate(DecoratedObjectFactory.java:79)
	at org.eclipse.jetty.servlet.ServletContextHandler$Context.createServlet(ServletContextHandler.java:1373)
	at org.eclipse.jetty.servlet.ServletHolder.newInstance(ServletHolder.java:1297)
	at org.eclipse.jetty.servlet.ServletHolder.initServlet(ServletHolder.java:647)
	... 29 more
Caused by:

java.lang.SecurityException: class "javax.annotation.Nullable"'s signer information does not match signer information of other classes in the same package
	at java.base/java.lang.ClassLoader.checkCerts(ClassLoader.java:1143)
	at java.base/java.lang.ClassLoader.preDefineClass(ClassLoader.java:898)
	at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1007)
	at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:174)
	at java.base/java.net.URLClassLoader.defineClass(URLClassLoader.java:545)
	at java.base/java.net.URLClassLoader.access$100(URLClassLoader.java:83)
	at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:453)
	at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:447)
	at java.base/java.security.AccessController.doPrivileged(Native Method)
	at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:446)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:566)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:499)
	at java.base/java.lang.Class.forName0(Native Method)
	at java.base/java.lang.Class.forName(Class.java:374)
	at java.base/sun.reflect.generics.factory.CoreReflectionFactory.makeNamedType(CoreReflectionFactory.java:114)
	at java.base/sun.reflect.generics.visitor.Reifier.visitClassTypeSignature(Reifier.java:125)
	at java.base/sun.reflect.generics.tree.ClassTypeSignature.accept(ClassTypeSignature.java:49)
	at java.base/sun.reflect.annotation.AnnotationParser.parseSig(AnnotationParser.java:439)
	at java.base/sun.reflect.annotation.AnnotationParser.parseAnnotation2(AnnotationParser.java:241)
	at java.base/sun.reflect.annotation.AnnotationParser.parseAnnotations2(AnnotationParser.java:120)
	at java.base/sun.reflect.annotation.AnnotationParser.parseAnnotations(AnnotationParser.java:72)
	at java.base/java.lang.reflect.Executable.declaredAnnotations(Executable.java:605)
	at java.base/java.lang.reflect.Executable.declaredAnnotations(Executable.java:603)
	at java.base/java.lang.reflect.Executable.getAnnotation(Executable.java:573)
	at java.base/java.lang.reflect.Method.getAnnotation(Method.java:693)
	at org.eclipse.jetty.annotations.ResourceAnnotationHandler.handleMethod(ResourceAnnotationHandler.java:226)
	at org.eclipse.jetty.annotations.ResourceAnnotationHandler.doHandle(ResourceAnnotationHandler.java:73)
	at org.eclipse.jetty.annotations.AnnotationIntrospector$AbstractIntrospectableAnnotationHandler.handle(AnnotationIntrospector.java:72)
	at org.eclipse.jetty.annotations.AnnotationIntrospector.introspect(AnnotationIntrospector.java:97)
	at org.eclipse.jetty.annotations.AnnotationDecorator.introspect(AnnotationDecorator.java:61)
	at org.eclipse.jetty.annotations.AnnotationDecorator.decorate(AnnotationDecorator.java:67)
	at org.eclipse.jetty.util.DecoratedObjectFactory.decorate(DecoratedObjectFactory.java:79)
	at org.eclipse.jetty.servlet.ServletContextHandler$Context.createServlet(ServletContextHandler.java:1373)
	at org.eclipse.jetty.servlet.ServletHolder.newInstance(ServletHolder.java:1297)
	at org.eclipse.jetty.servlet.ServletHolder.initServlet(ServletHolder.java:647)
	at org.eclipse.jetty.servlet.ServletHolder.getServlet(ServletHolder.java:519)
	at org.eclipse.jetty.servlet.ServletHolder.prepare(ServletHolder.java:803)
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:530)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:146)
	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:524)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:257)
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1595)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:255)
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1253)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:203)
	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:473)
	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1564)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:201)
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1155)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:144)
	at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:219)
	at org.eclipse.jetty.server.handler.HandlerCollection.handle(HandlerCollection.java:126)
	at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:674)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)
	at org.eclipse.jetty.server.Server.handle(Server.java:531)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:352)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:260)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:281)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:102)
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:118)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:760)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:678)
	at java.base/java.lang.Thread.run(Thread.java:844)

@adamretter
Copy link
Member

@dizzzz So if I understand your change, it just additionally signs one jar file, which is tools/jetty/lib/javax.annotation-api-*.jar?

But I am not sure why we need to do that, as the error message says:

java.lang.SecurityException: class "javax.annotation.Nullable"'s signer information does not match signer information of other classes in the same package

From what I can see, the class javax.annotation.Nullable is only in the lib/core/jsr305-3.0.2.jar jar file, which is already signed as part of the build.

Can you explain a bit about how and why your change works?

@dizzzz
Copy link
Member Author

dizzzz commented Jun 24, 2018

Java 10 is more strict on its class loader. It requires now all classes in a package to be signed with the same certificate.

Until now, Java allowed to have jar file #1 (read: the jsr jar) to provide a number of signed classes, and jar files #2 (the one from jetty) to provide unsigned classes, in the java java.annotation package.

By signing the jar from jetty we enforce now all classes in both jar files to be signed identically.

@dizzzz
Copy link
Member Author

dizzzz commented Jun 24, 2018

note that the hint is actually in the stacktrace:

"class "javax.annotation.Nullable"'s signer information does not match signer information of other classes in the same package"

read the "does not match" with some fantasy :-P but it is all about classes in the same package.

@dizzzz dizzzz requested a review from adamretter June 24, 2018 16:19
@dizzzz dizzzz added the bug issue confirmed as bug label Jun 24, 2018
@adamretter
Copy link
Member

@dizzzz Ah okay, now I understand. Thank you :-)

@adamretter adamretter changed the title 4.x.x: Fix Java10 signing problem (4.x.x) Fix Java10 signing problem Jun 25, 2018
@adamretter adamretter added this to the eXist-4.2.2 milestone Jun 25, 2018
@adamretter adamretter merged commit bbd487d into eXist-db:develop-4.x.x Jun 25, 2018
@dizzzz dizzzz deleted the bugfix/java10_signing branch June 25, 2018 19:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug issue confirmed as bug
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants