Cannot require 'openssl' in a signed jruby jar as of jruby 1.7.3

[jeffgran]

I cannot sign the jruby-complete jar and run it any more, after upgrading to the latest version. I "binary searched" to find where the problem first starts happening, and it's the upgrade to jruby 1.7.3 from 1.7.2 that breaks this.

The reason I need to sign the jar is because I am deploying my application via a JNLP (Java Web Start), and java security requirements dictate that I have to sign all of the jars. I have tried unjaring, signing everything (including the jopenssl.jar, the bouncycastle jars, etc) re-creating the jruby-complete jar and then signing it too, but that doesn't work either.

I very well may just be "doing it wrong" but can not figure out the right way.

Under jruby 1.7.2:

$ java -jar jruby-complete-1.7.2.jar -e 'require "openssl"; puts OpenSSL.inspect'
OpenSSL
$ cp jruby-complete-1.7.2.jar jruby-complete-1.7.2-signed.jar
$ jarsigner -keystore my-keystore jruby-complete-1.7.2-signed.jar my-alias
$ java -jar jruby-complete-1.7.2-signed.jar -e 'require "openssl"; puts OpenSSL.inspect'
OpenSSL

Starting with 1.7.3 all the way up to 1.7.12:

$ java -jar jruby-complete-1.7.12.jar -e 'require "openssl"; puts OpenSSL.inspect'
OpenSSL
$ cp jruby-complete-1.7.12.jar jruby-complete-1.7.12-signed.jar
$ jarsigner -keystore my-keystore jruby-complete-1.7.12-signed.jar my-alias
$ java -jar jruby-complete-1.7.12-signed.jar -e 'require "openssl"; puts OpenSSL.inspect'

java.lang.SecurityException: class "org.jruby.ext.openssl.OpenSSLReal$OpenSSLModule$INVOKER$s$0$0$errors"'s signer information does not match signer information of other classes in the same package
at java.lang.ClassLoader.checkCerts(ClassLoader.java:952)
at java.lang.ClassLoader.preDefineClass(ClassLoader.java:666)
at java.lang.ClassLoader.defineClass(ClassLoader.java:794)
at org.jruby.util.JRubyClassLoader.defineClass(JRubyClassLoader.java:118)
at org.jruby.internal.runtime.methods.InvocationMethodFactory.endClass(InvocationMethodFactory.java:1455)
at org.jruby.internal.runtime.methods.InvocationMethodFactory.getAnnotatedMethodClass(InvocationMethodFactory.java:847)
at org.jruby.internal.runtime.methods.InvocationMethodFactory.getAnnotatedMethod(InvocationMethodFactory.java:894)
at org.jruby.RubyModule.defineAnnotatedMethod(RubyModule.java:805)
at org.jruby.RubyModule.defineAnnotatedMethod(RubyModule.java:768)
at org.jruby.anno.TypePopulator$DefaultTypePopulator.populate(TypePopulator.java:96)
at org.jruby.RubyModule.defineAnnotatedMethodsIndividually(RubyModule.java:762)
at org.jruby.RubyModule.defineAnnotatedMethods(RubyModule.java:633)
at org.jruby.ext.openssl.OpenSSLReal.createOpenSSL(OpenSSLReal.java:112)
at org.jruby.ext.openssl.OSSLLibrary.load(OSSLLibrary.java:11)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(JavaMethod.java:470)
at org.jruby.javasupport.JavaMethod.invokeDirect(JavaMethod.java:328)
at org.jruby.java.invokers.InstanceMethodInvoker.call(InstanceMethodInvoker.java:71)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:346)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:204)
at org.jruby.ast.CallTwoArgNode.interpret(CallTwoArgNode.java:59)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.RootNode.interpret(RootNode.java:129)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_ROOT(ASTInterpreter.java:121)
at org.jruby.Ruby.runInterpreter(Ruby.java:838)
at org.jruby.Ruby.loadFile(Ruby.java:2766)
at org.jruby.runtime.load.ExternalScript.load(ExternalScript.java:66)
at org.jruby.runtime.load.LoadService.tryLoadingLibraryOrScript(LoadService.java:959)
at org.jruby.runtime.load.LoadService.smartLoadInternal(LoadService.java:573)
at org.jruby.runtime.load.LoadService.requireCommon(LoadService.java:457)
at org.jruby.runtime.load.LoadService.require(LoadService.java:421)
at org.jruby.RubyKernel.requireCommon(RubyKernel.java:1071)
at org.jruby.RubyKernel.require19(RubyKernel.java:1065)
at org.jruby.RubyKernel$INVOKER$s$1$0$require19.call(RubyKernel$INVOKER$s$1$0$require19.gen)
at org.jruby.internal.runtime.methods.JavaMethod$JavaMethodOneOrNBlock.call(JavaMethod.java:350)
at org.jruby.internal.runtime.methods.AliasMethod.call(AliasMethod.java:61)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:168)
at org.jruby.ast.FCallOneArgNode.interpret(FCallOneArgNode.java:36)
at org.jruby.ast.ReturnNode.interpret(ReturnNode.java:92)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.ast.BeginNode.interpret(BeginNode.java:83)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.IfNode.interpret(IfNode.java:116)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.RescueNode.executeBody(RescueNode.java:221)
at org.jruby.ast.RescueNode.interpret(RescueNode.java:116)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)
at org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)
at org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:198)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)
at org.jruby.ast.FCallOneArgNode.interpret(FCallOneArgNode.java:36)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.RootNode.interpret(RootNode.java:129)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_ROOT(ASTInterpreter.java:121)
at org.jruby.Ruby.runInterpreter(Ruby.java:838)
at org.jruby.Ruby.loadFile(Ruby.java:2766)
at org.jruby.runtime.load.ExternalScript.load(ExternalScript.java:66)
at org.jruby.runtime.load.LoadService.tryLoadingLibraryOrScript(LoadService.java:959)
at org.jruby.runtime.load.LoadService.smartLoadInternal(LoadService.java:573)
at org.jruby.runtime.load.LoadService.requireCommon(LoadService.java:457)
at org.jruby.runtime.load.LoadService.require(LoadService.java:421)
at org.jruby.RubyKernel.requireCommon(RubyKernel.java:1071)
at org.jruby.RubyKernel.require19(RubyKernel.java:1065)
at org.jruby.RubyKernel$INVOKER$s$1$0$require19.call(RubyKernel$INVOKER$s$1$0$require19.gen)
at org.jruby.internal.runtime.methods.JavaMethod$JavaMethodOneOrNBlock.call(JavaMethod.java:350)
at org.jruby.internal.runtime.methods.AliasMethod.call(AliasMethod.java:61)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)
at org.jruby.ast.FCallOneArgNode.interpret(FCallOneArgNode.java:36)
at org.jruby.ast.ReturnNode.interpret(ReturnNode.java:92)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.ast.BeginNode.interpret(BeginNode.java:83)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.IfNode.interpret(IfNode.java:116)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.RescueNode.executeBody(RescueNode.java:221)
at org.jruby.ast.RescueNode.interpret(RescueNode.java:116)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)
at org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)
at org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:198)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)
at ruby.dash_e.file(-e:1)
at ruby.dash_e.load(-e)
at org.jruby.Ruby.runScript(Ruby.java:811)
at org.jruby.Ruby.runScript(Ruby.java:804)
at org.jruby.Ruby.runNormally(Ruby.java:673)
at org.jruby.Ruby.runFromMain(Ruby.java:522)
at org.jruby.Main.doRunFromMain(Main.java:395)
at org.jruby.Main.internalRun(Main.java:290)
at org.jruby.Main.run(Main.java:217)
at org.jruby.Main.main(Main.java:197)
LoadError: class "org.jruby.ext.openssl.OpenSSLReal$OpenSSLModule$INVOKER$s$0$0$errors"'s signer information does not match signer information of other classes in the same package
(root) at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/jopenssl/load.rb:15
require at org/jruby/RubyKernel.java:1065
(root) at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/rubygems/core_ext/kernel_require.rb:1
require at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/rubygems/core_ext/kernel_require.rb:55
require at org/jruby/RubyKernel.java:1065
(root) at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/openssl.rb:1
(root) at -e:1

[jeffgran]

From what I can tell, this is the crucial line:

at org.jruby.RubyModule.defineAnnotatedMethods(RubyModule.java:633)
at org.jruby.ext.openssl.OpenSSLReal.createOpenSSL(OpenSSLReal.java:112)

It looks like it's dynamically defining a new jruby module based on the java code inside OpenSSLReal.java... and that newly defined class is not signed since it didn't exist at compile time? Just guessing based on my limited knowledge of the jruby codebase and java in general...

Any ideas on approaches to how to fix this?

[kares]

expect this to go away in the next release that bundles JOpenSSL >= 0.9.6 (likely JRuby 1.7.16)
... as we're now generating JRuby-OpenSSL invokers in advance.

[jeffgran]

@kares That's great news! I'll look forward to testing that out when it's available. Thanks for the update.

[jeffgran]

@kares I was able to verify that JOpenSSL 0.9.6 fixes this issue, by hacking the pom.rb and pom.xml in the latest jruby-1_7 branch to update to 0.9.6.

I hate to be a pest, but is there any chance of releasing a 1.7.x with this upgrade? If not I can of course use my custom-built snapshot jar.

[kares]

@jeffgran glad to hear that ... updating to 0.9.6 for the next 1.7.x release was definitely the plan!

pls, go ahead and open a PR with the pom updated (against jruby-1_7), so that it's not forgotten ...