upgrading vision past 1.33.0 gives IllegalArgumentException: SunJSSE selected, but Jetty NPN/ALPN unavailable

[efenderbosch]

I'm running a discord bot on a raspberry pi and using vision to perform OCR on mobile screenshots. It works fine with 1.33 and lower, but 1.34 and 1.35 throw IllegalArgumentException: SunJSSE selected, but Jetty NPN/ALPN unavailable.

uname -a
Linux raspberrypi 4.14.50-v7+ #1122 SMP Tue Jun 19 12:26:26 BST 2018 armv7l GNU/Linux

I'm running a build of Java 10 from here (since the official openjdk binaries are 64 bit):

https://www.bell-sw.com/java-for-raspberry-pi.html

java --version
openjdk 10.0.1-BellSoft 2018-04-17
OpenJDK Runtime Environment (build 10.0.1-BellSoft+0)
OpenJDK Server VM (build 10.0.1-BellSoft+0, mixed mode)

Relvant stack trace from 1.35:

java.lang.IllegalArgumentException: SunJSSE selected, but Jetty NPN/ALPN unavailable
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.configure(GrpcSslContexts.java:223)
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.configure(GrpcSslContexts.java:189)
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.configure(GrpcSslContexts.java:171)
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.forClient(GrpcSslContexts.java:120)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder$NettyTransportFactory$DefaultNettyTransportCreationParamsFilterFactory.<init>(NettyChannelBuilder.java:558)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder$NettyTransportFactory$DefaultNettyTransportCreationParamsFilterFactory.<init>(NettyChannelBuilder.java:551)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder$NettyTransportFactory.<init>(NettyChannelBuilder.java:489)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder.buildTransportFactory(NettyChannelBuilder.java:337)
	at io.grpc.internal.AbstractManagedChannelImplBuilder.build(AbstractManagedChannelImplBuilder.java:390)
	at com.google.api.gax.grpc.InstantiatingGrpcChannelProvider.createSingleChannel(InstantiatingGrpcChannelProvider.java:206)
	at com.google.api.gax.grpc.InstantiatingGrpcChannelProvider.createChannel(InstantiatingGrpcChannelProvider.java:157)
	at com.google.api.gax.grpc.InstantiatingGrpcChannelProvider.getTransportChannel(InstantiatingGrpcChannelProvider.java:149)
	at com.google.api.gax.rpc.ClientContext.create(ClientContext.java:151)
	at com.google.cloud.vision.v1.stub.GrpcImageAnnotatorStub.create(GrpcImageAnnotatorStub.java:84)
	at com.google.cloud.vision.v1.stub.ImageAnnotatorStubSettings.createStub(ImageAnnotatorStubSettings.java:120)
	at com.google.cloud.vision.v1.ImageAnnotatorClient.<init>(ImageAnnotatorClient.java:136)
	at com.google.cloud.vision.v1.ImageAnnotatorClient.create(ImageAnnotatorClient.java:117)
	at com.google.cloud.vision.v1.ImageAnnotatorClient.create(ImageAnnotatorClient.java:108)

Is this a bug, or intentional? Can I enable or disable something via config to update the client?

[efenderbosch]

I rolled the project back to 1.8 and get a different stack trace:

java.lang.IllegalStateException: Could not find TLS ALPN provider; no working netty-tcnative, Conscrypt, or Jetty NPN/ALPN available
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.defaultSslProvider(GrpcSslContexts.java:256)
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.configure(GrpcSslContexts.java:171)
	at io.grpc.netty.shaded.io.grpc.netty.GrpcSslContexts.forClient(GrpcSslContexts.java:120)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder$NettyTransportFactory$DefaultNettyTransportCreationParamsFilterFactory.<init>(NettyChannelBuilder.java:558)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder$NettyTransportFactory$DefaultNettyTransportCreationParamsFilterFactory.<init>(NettyChannelBuilder.java:551)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder$NettyTransportFactory.<init>(NettyChannelBuilder.java:489)
	at io.grpc.netty.shaded.io.grpc.netty.NettyChannelBuilder.buildTransportFactory(NettyChannelBuilder.java:337)
	at io.grpc.internal.AbstractManagedChannelImplBuilder.build(AbstractManagedChannelImplBuilder.java:390)
	at com.google.api.gax.grpc.InstantiatingGrpcChannelProvider.createSingleChannel(InstantiatingGrpcChannelProvider.java:206)
	at com.google.api.gax.grpc.InstantiatingGrpcChannelProvider.createChannel(InstantiatingGrpcChannelProvider.java:157)
	at com.google.api.gax.grpc.InstantiatingGrpcChannelProvider.getTransportChannel(InstantiatingGrpcChannelProvider.java:149)
	at com.google.api.gax.rpc.ClientContext.create(ClientContext.java:151)
	at com.google.cloud.vision.v1.stub.GrpcImageAnnotatorStub.create(GrpcImageAnnotatorStub.java:84)
	at com.google.cloud.vision.v1.stub.ImageAnnotatorStubSettings.createStub(ImageAnnotatorStubSettings.java:120)
	at com.google.cloud.vision.v1.ImageAnnotatorClient.<init>(ImageAnnotatorClient.java:136)
	at com.google.cloud.vision.v1.ImageAnnotatorClient.create(ImageAnnotatorClient.java:117)
	at com.google.cloud.vision.v1.ImageAnnotatorClient.create(ImageAnnotatorClient.java:108)

[zpencer]

We have a doc explaining what the NPN/ALPN error may mean: https://github.com/grpc/grpc-java/blob/master/SECURITY.md

But I think you'll need to open an issue with the cloud vision project for them to investigate, since your issues appeared when upgrading their library rather than you doing anything with gRPC directly: https://github.com/GoogleCloudPlatform/cloud-vision

[ejona86]

This looks like a bug in gRPC. Java 10 supports ALPN, so we choose SunJSSE in findJdkProvider() but then fail in configure(). I'll have to check why TlsTest isn't noticing this.

@efenderbosch, you simply said you're using "vision". What artifact is that/what version of gRPC is it using? It looks like you may be referring to com.google.cloud:google-cloud-vision. It looks like the failure corresponds with an upgrade from grpc 1.10.1 to 1.12.0. It looks like I regressed this when adding Conscrypt support.

Most users wouldn't hit this with vision because it uses grpc-netty-shaded, which includes netty-tcnative. But in your case you're on ARM, of which there's no pre-built binary for netty-tcnative.

[ejona86]

FYI, @garrettjonesgoogle

[ejona86]

I've got a fix out for this in #4625. If it would be helpful, I can backport it to 1.10.x and later, but if it doesn't matter to @efenderbosch (or anyone else), I will just backport it to v1.13.x.

@garrettjonesgoogle, I'm sort of assuming that you'd just like a v1.13.2 release with this in it; you wouldn't use an older patch release (like v1.10.2) even if I made it. Is that right?

[garrettjonesgoogle]

Correct - users could override grpc themselves for older releases of google-cloud-java if they really needed to; we can just bump to the latest grpc in google-cloud-java.

[efenderbosch]

Sorry for not responding sooner. Specific dependency is com.google.cloud:google-cloud-vision

    <dependency>
        <groupId>com.google.cloud</groupId>
        <artifactId>google-cloud-vision</artifactId>
        <version>1.33.0</version>
    </dependency>

[ejona86]

@efenderbosch, that release of cloud vision is using grpc-java 1.10.1. Once it is released, would you be comfortable using a grpc-java v1.13.2 that includes the fix?

[ejona86]

@efenderbosch, oops. The failure was actually with grpc 1.12.0; that's much more recent. I'll backport it to v1.12.x in addition to v1.13.x.