Skip to content

/jruby

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot require 'openssl' in a signed jruby jar as of jruby 1.7.3 #1719

Closed
jeffgran opened this Issue May 29, 2014 · 5 comments

Comments

Assignees
No one assigned
Labels
openssl
Projects
None yet
Milestone
  JRuby 1.7.20
4 participants
@jeffgran @kares @enebo @mkristian
@jeffgran
Copy link

jeffgran commented May 29, 2014

I cannot sign the jruby-complete jar and run it any more, after upgrading to the latest version. I "binary searched" to find where the problem first starts happening, and it's the upgrade to jruby 1.7.3 from 1.7.2 that breaks this.

The reason I need to sign the jar is because I am deploying my application via a JNLP (Java Web Start), and java security requirements dictate that I have to sign all of the jars. I have tried unjaring, signing everything (including the jopenssl.jar, the bouncycastle jars, etc) re-creating the jruby-complete jar and then signing it too, but that doesn't work either.

I very well may just be "doing it wrong" but can not figure out the right way.

Under jruby 1.7.2:

$ java -jar jruby-complete-1.7.2.jar -e 'require "openssl"; puts OpenSSL.inspect'
OpenSSL
$ cp jruby-complete-1.7.2.jar jruby-complete-1.7.2-signed.jar
$ jarsigner -keystore my-keystore jruby-complete-1.7.2-signed.jar my-alias
$ java -jar jruby-complete-1.7.2-signed.jar -e 'require "openssl"; puts OpenSSL.inspect'
OpenSSL

Starting with 1.7.3 all the way up to 1.7.12:

$ java -jar jruby-complete-1.7.12.jar -e 'require "openssl"; puts OpenSSL.inspect'
OpenSSL
$ cp jruby-complete-1.7.12.jar jruby-complete-1.7.12-signed.jar
$ jarsigner -keystore my-keystore jruby-complete-1.7.12-signed.jar my-alias
$ java -jar jruby-complete-1.7.12-signed.jar -e 'require "openssl"; puts OpenSSL.inspect'

java.lang.SecurityException: class "org.jruby.ext.openssl.OpenSSLReal$OpenSSLModule$INVOKER$s$0$0$errors"'s signer information does not match signer information of other classes in the same package
at java.lang.ClassLoader.checkCerts(ClassLoader.java:952)
at java.lang.ClassLoader.preDefineClass(ClassLoader.java:666)
at java.lang.ClassLoader.defineClass(ClassLoader.java:794)
at org.jruby.util.JRubyClassLoader.defineClass(JRubyClassLoader.java:118)
at org.jruby.internal.runtime.methods.InvocationMethodFactory.endClass(InvocationMethodFactory.java:1455)
at org.jruby.internal.runtime.methods.InvocationMethodFactory.getAnnotatedMethodClass(InvocationMethodFactory.java:847)
at org.jruby.internal.runtime.methods.InvocationMethodFactory.getAnnotatedMethod(InvocationMethodFactory.java:894)
at org.jruby.RubyModule.defineAnnotatedMethod(RubyModule.java:805)
at org.jruby.RubyModule.defineAnnotatedMethod(RubyModule.java:768)
at org.jruby.anno.TypePopulator$DefaultTypePopulator.populate(TypePopulator.java:96)
at org.jruby.RubyModule.defineAnnotatedMethodsIndividually(RubyModule.java:762)
at org.jruby.RubyModule.defineAnnotatedMethods(RubyModule.java:633)
at org.jruby.ext.openssl.OpenSSLReal.createOpenSSL(OpenSSLReal.java:112)
at org.jruby.ext.openssl.OSSLLibrary.load(OSSLLibrary.java:11)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(JavaMethod.java:470)
at org.jruby.javasupport.JavaMethod.invokeDirect(JavaMethod.java:328)
at org.jruby.java.invokers.InstanceMethodInvoker.call(InstanceMethodInvoker.java:71)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:346)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:204)
at org.jruby.ast.CallTwoArgNode.interpret(CallTwoArgNode.java:59)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.RootNode.interpret(RootNode.java:129)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_ROOT(ASTInterpreter.java:121)
at org.jruby.Ruby.runInterpreter(Ruby.java:838)
at org.jruby.Ruby.loadFile(Ruby.java:2766)
at org.jruby.runtime.load.ExternalScript.load(ExternalScript.java:66)
at org.jruby.runtime.load.LoadService.tryLoadingLibraryOrScript(LoadService.java:959)
at org.jruby.runtime.load.LoadService.smartLoadInternal(LoadService.java:573)
at org.jruby.runtime.load.LoadService.requireCommon(LoadService.java:457)
at org.jruby.runtime.load.LoadService.require(LoadService.java:421)
at org.jruby.RubyKernel.requireCommon(RubyKernel.java:1071)
at org.jruby.RubyKernel.require19(RubyKernel.java:1065)
at org.jruby.RubyKernel$INVOKER$s$1$0$require19.call(RubyKernel$INVOKER$s$1$0$require19.gen)
at org.jruby.internal.runtime.methods.JavaMethod$JavaMethodOneOrNBlock.call(JavaMethod.java:350)
at org.jruby.internal.runtime.methods.AliasMethod.call(AliasMethod.java:61)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:168)
at org.jruby.ast.FCallOneArgNode.interpret(FCallOneArgNode.java:36)
at org.jruby.ast.ReturnNode.interpret(ReturnNode.java:92)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.ast.BeginNode.interpret(BeginNode.java:83)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.IfNode.interpret(IfNode.java:116)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.RescueNode.executeBody(RescueNode.java:221)
at org.jruby.ast.RescueNode.interpret(RescueNode.java:116)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)
at org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)
at org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:198)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)
at org.jruby.ast.FCallOneArgNode.interpret(FCallOneArgNode.java:36)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.RootNode.interpret(RootNode.java:129)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_ROOT(ASTInterpreter.java:121)
at org.jruby.Ruby.runInterpreter(Ruby.java:838)
at org.jruby.Ruby.loadFile(Ruby.java:2766)
at org.jruby.runtime.load.ExternalScript.load(ExternalScript.java:66)
at org.jruby.runtime.load.LoadService.tryLoadingLibraryOrScript(LoadService.java:959)
at org.jruby.runtime.load.LoadService.smartLoadInternal(LoadService.java:573)
at org.jruby.runtime.load.LoadService.requireCommon(LoadService.java:457)
at org.jruby.runtime.load.LoadService.require(LoadService.java:421)
at org.jruby.RubyKernel.requireCommon(RubyKernel.java:1071)
at org.jruby.RubyKernel.require19(RubyKernel.java:1065)
at org.jruby.RubyKernel$INVOKER$s$1$0$require19.call(RubyKernel$INVOKER$s$1$0$require19.gen)
at org.jruby.internal.runtime.methods.JavaMethod$JavaMethodOneOrNBlock.call(JavaMethod.java:350)
at org.jruby.internal.runtime.methods.AliasMethod.call(AliasMethod.java:61)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)
at org.jruby.ast.FCallOneArgNode.interpret(FCallOneArgNode.java:36)
at org.jruby.ast.ReturnNode.interpret(ReturnNode.java:92)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.ast.BeginNode.interpret(BeginNode.java:83)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.IfNode.interpret(IfNode.java:116)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.RescueNode.executeBody(RescueNode.java:221)
at org.jruby.ast.RescueNode.interpret(RescueNode.java:116)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)
at org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)
at org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:198)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)
at ruby.dash_e.file(-e:1)
at ruby.dash_e.load(-e)
at org.jruby.Ruby.runScript(Ruby.java:811)
at org.jruby.Ruby.runScript(Ruby.java:804)
at org.jruby.Ruby.runNormally(Ruby.java:673)
at org.jruby.Ruby.runFromMain(Ruby.java:522)
at org.jruby.Main.doRunFromMain(Main.java:395)
at org.jruby.Main.internalRun(Main.java:290)
at org.jruby.Main.run(Main.java:217)
at org.jruby.Main.main(Main.java:197)
LoadError: class "org.jruby.ext.openssl.OpenSSLReal$OpenSSLModule$INVOKER$s$0$0$errors"'s signer information does not match signer information of other classes in the same package
(root) at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/jopenssl/load.rb:15
require at org/jruby/RubyKernel.java:1065
(root) at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/rubygems/core_ext/kernel_require.rb:1
require at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/rubygems/core_ext/kernel_require.rb:55
require at org/jruby/RubyKernel.java:1065
(root) at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/openssl.rb:1
(root) at -e:1
@jeffgran

This comment has been minimized.

Sign in to view
Copy link
Author

jeffgran commented May 30, 2014

From what I can tell, this is the crucial line:

at org.jruby.RubyModule.defineAnnotatedMethods(RubyModule.java:633)
at org.jruby.ext.openssl.OpenSSLReal.createOpenSSL(OpenSSLReal.java:112)

It looks like it's dynamically defining a new jruby module based on the java code inside OpenSSLReal.java... and that newly defined class is not signed since it didn't exist at compile time? Just guessing based on my limited knowledge of the jruby codebase and java in general...

Any ideas on approaches to how to fix this?

@mkristian mkristian added the openssl label Jun 25, 2014

@kares

This comment has been minimized.

Sign in to view
Copy link
Member

kares commented Sep 6, 2014

expect this to go away in the next release that bundles JOpenSSL >= 0.9.6 (likely JRuby 1.7.16)
... as we're now generating JRuby-OpenSSL invokers in advance.
@jeffgran

This comment has been minimized.

Sign in to view
Copy link
Author

jeffgran commented Sep 10, 2014

@kares That's great news! I'll look forward to testing that out when it's available. Thanks for the update.
@jeffgran

This comment has been minimized.

Sign in to view
Copy link
Author

jeffgran commented Jan 21, 2015

@kares I was able to verify that JOpenSSL 0.9.6 fixes this issue, by hacking the pom.rb and pom.xml in the latest jruby-1_7 branch to update to 0.9.6.

I hate to be a pest, but is there any chance of releasing a 1.7.x with this upgrade? If not I can of course use my custom-built snapshot jar.
@kares

This comment has been minimized.

Sign in to view
Copy link
Member

kares commented Jan 22, 2015

@jeffgran glad to hear that ... updating to 0.9.6 for the next 1.7.x release was definitely the plan!

pls, go ahead and open a PR with the pom updated (against jruby-1_7), so that it's not forgotten ...

@jeffgran jeffgran referenced this issue Jan 22, 2015

Closed

upgrade to jruby-openssl 0.9.6 #2501

@kares kares closed this Feb 27, 2015

@enebo enebo added this to the JRuby 1.7.20 milestone Apr 28, 2015

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.