Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Cannot require 'openssl' in a signed jruby jar as of jruby 1.7.3 #1719

Closed
jeffgran opened this issue May 29, 2014 · 5 comments
Closed

Cannot require 'openssl' in a signed jruby jar as of jruby 1.7.3 #1719

jeffgran opened this issue May 29, 2014 · 5 comments
Labels
openssl
Milestone
JRuby 1.7.20

Comments

@jeffgran
Copy link

I cannot sign the jruby-complete jar and run it any more, after upgrading to the latest version. I "binary searched" to find where the problem first starts happening, and it's the upgrade to jruby 1.7.3 from 1.7.2 that breaks this.

The reason I need to sign the jar is because I am deploying my application via a JNLP (Java Web Start), and java security requirements dictate that I have to sign all of the jars. I have tried unjaring, signing everything (including the jopenssl.jar, the bouncycastle jars, etc) re-creating the jruby-complete jar and then signing it too, but that doesn't work either.

I very well may just be "doing it wrong" but can not figure out the right way.

Under jruby 1.7.2:

$ java -jar jruby-complete-1.7.2.jar -e 'require "openssl"; puts OpenSSL.inspect'
OpenSSL
$ cp jruby-complete-1.7.2.jar jruby-complete-1.7.2-signed.jar
$ jarsigner -keystore my-keystore jruby-complete-1.7.2-signed.jar my-alias
$ java -jar jruby-complete-1.7.2-signed.jar -e 'require "openssl"; puts OpenSSL.inspect'
OpenSSL

Starting with 1.7.3 all the way up to 1.7.12:

$ java -jar jruby-complete-1.7.12.jar -e 'require "openssl"; puts OpenSSL.inspect'
OpenSSL
$ cp jruby-complete-1.7.12.jar jruby-complete-1.7.12-signed.jar
$ jarsigner -keystore my-keystore jruby-complete-1.7.12-signed.jar my-alias
$ java -jar jruby-complete-1.7.12-signed.jar -e 'require "openssl"; puts OpenSSL.inspect'

java.lang.SecurityException: class "org.jruby.ext.openssl.OpenSSLReal$OpenSSLModule$INVOKER$s$0$0$errors"'s signer information does not match signer information of other classes in the same package
at java.lang.ClassLoader.checkCerts(ClassLoader.java:952)
at java.lang.ClassLoader.preDefineClass(ClassLoader.java:666)
at java.lang.ClassLoader.defineClass(ClassLoader.java:794)
at org.jruby.util.JRubyClassLoader.defineClass(JRubyClassLoader.java:118)
at org.jruby.internal.runtime.methods.InvocationMethodFactory.endClass(InvocationMethodFactory.java:1455)
at org.jruby.internal.runtime.methods.InvocationMethodFactory.getAnnotatedMethodClass(InvocationMethodFactory.java:847)
at org.jruby.internal.runtime.methods.InvocationMethodFactory.getAnnotatedMethod(InvocationMethodFactory.java:894)
at org.jruby.RubyModule.defineAnnotatedMethod(RubyModule.java:805)
at org.jruby.RubyModule.defineAnnotatedMethod(RubyModule.java:768)
at org.jruby.anno.TypePopulator$DefaultTypePopulator.populate(TypePopulator.java:96)
at org.jruby.RubyModule.defineAnnotatedMethodsIndividually(RubyModule.java:762)
at org.jruby.RubyModule.defineAnnotatedMethods(RubyModule.java:633)
at org.jruby.ext.openssl.OpenSSLReal.createOpenSSL(OpenSSLReal.java:112)
at org.jruby.ext.openssl.OSSLLibrary.load(OSSLLibrary.java:11)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.jruby.javasupport.JavaMethod.invokeDirectWithExceptionHandling(JavaMethod.java:470)
at org.jruby.javasupport.JavaMethod.invokeDirect(JavaMethod.java:328)
at org.jruby.java.invokers.InstanceMethodInvoker.call(InstanceMethodInvoker.java:71)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:346)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:204)
at org.jruby.ast.CallTwoArgNode.interpret(CallTwoArgNode.java:59)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.RootNode.interpret(RootNode.java:129)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_ROOT(ASTInterpreter.java:121)
at org.jruby.Ruby.runInterpreter(Ruby.java:838)
at org.jruby.Ruby.loadFile(Ruby.java:2766)
at org.jruby.runtime.load.ExternalScript.load(ExternalScript.java:66)
at org.jruby.runtime.load.LoadService.tryLoadingLibraryOrScript(LoadService.java:959)
at org.jruby.runtime.load.LoadService.smartLoadInternal(LoadService.java:573)
at org.jruby.runtime.load.LoadService.requireCommon(LoadService.java:457)
at org.jruby.runtime.load.LoadService.require(LoadService.java:421)
at org.jruby.RubyKernel.requireCommon(RubyKernel.java:1071)
at org.jruby.RubyKernel.require19(RubyKernel.java:1065)
at org.jruby.RubyKernel$INVOKER$s$1$0$require19.call(RubyKernel$INVOKER$s$1$0$require19.gen)
at org.jruby.internal.runtime.methods.JavaMethod$JavaMethodOneOrNBlock.call(JavaMethod.java:350)
at org.jruby.internal.runtime.methods.AliasMethod.call(AliasMethod.java:61)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:168)
at org.jruby.ast.FCallOneArgNode.interpret(FCallOneArgNode.java:36)
at org.jruby.ast.ReturnNode.interpret(ReturnNode.java:92)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.ast.BeginNode.interpret(BeginNode.java:83)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.IfNode.interpret(IfNode.java:116)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.RescueNode.executeBody(RescueNode.java:221)
at org.jruby.ast.RescueNode.interpret(RescueNode.java:116)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)
at org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)
at org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:198)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)
at org.jruby.ast.FCallOneArgNode.interpret(FCallOneArgNode.java:36)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.RootNode.interpret(RootNode.java:129)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_ROOT(ASTInterpreter.java:121)
at org.jruby.Ruby.runInterpreter(Ruby.java:838)
at org.jruby.Ruby.loadFile(Ruby.java:2766)
at org.jruby.runtime.load.ExternalScript.load(ExternalScript.java:66)
at org.jruby.runtime.load.LoadService.tryLoadingLibraryOrScript(LoadService.java:959)
at org.jruby.runtime.load.LoadService.smartLoadInternal(LoadService.java:573)
at org.jruby.runtime.load.LoadService.requireCommon(LoadService.java:457)
at org.jruby.runtime.load.LoadService.require(LoadService.java:421)
at org.jruby.RubyKernel.requireCommon(RubyKernel.java:1071)
at org.jruby.RubyKernel.require19(RubyKernel.java:1065)
at org.jruby.RubyKernel$INVOKER$s$1$0$require19.call(RubyKernel$INVOKER$s$1$0$require19.gen)
at org.jruby.internal.runtime.methods.JavaMethod$JavaMethodOneOrNBlock.call(JavaMethod.java:350)
at org.jruby.internal.runtime.methods.AliasMethod.call(AliasMethod.java:61)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)
at org.jruby.ast.FCallOneArgNode.interpret(FCallOneArgNode.java:36)
at org.jruby.ast.ReturnNode.interpret(ReturnNode.java:92)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.ast.BeginNode.interpret(BeginNode.java:83)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.IfNode.interpret(IfNode.java:116)
at org.jruby.ast.NewlineNode.interpret(NewlineNode.java:105)
at org.jruby.ast.BlockNode.interpret(BlockNode.java:71)
at org.jruby.ast.RescueNode.executeBody(RescueNode.java:221)
at org.jruby.ast.RescueNode.interpret(RescueNode.java:116)
at org.jruby.ast.EnsureNode.interpret(EnsureNode.java:96)
at org.jruby.evaluator.ASTInterpreter.INTERPRET_METHOD(ASTInterpreter.java:74)
at org.jruby.internal.runtime.methods.InterpretedMethod.call(InterpretedMethod.java:182)
at org.jruby.internal.runtime.methods.DefaultMethod.call(DefaultMethod.java:198)
at org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:326)
at org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:170)
at ruby.dash_e.file(-e:1)
at ruby.dash_e.load(-e)
at org.jruby.Ruby.runScript(Ruby.java:811)
at org.jruby.Ruby.runScript(Ruby.java:804)
at org.jruby.Ruby.runNormally(Ruby.java:673)
at org.jruby.Ruby.runFromMain(Ruby.java:522)
at org.jruby.Main.doRunFromMain(Main.java:395)
at org.jruby.Main.internalRun(Main.java:290)
at org.jruby.Main.run(Main.java:217)
at org.jruby.Main.main(Main.java:197)
LoadError: class "org.jruby.ext.openssl.OpenSSLReal$OpenSSLModule$INVOKER$s$0$0$errors"'s signer information does not match signer information of other classes in the same package
(root) at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/jopenssl/load.rb:15
require at org/jruby/RubyKernel.java:1065
(root) at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/rubygems/core_ext/kernel_require.rb:1
require at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/rubygems/core_ext/kernel_require.rb:55
require at org/jruby/RubyKernel.java:1065
(root) at file:/Users/jgran/jruby-bug/jruby-complete-1.7.12-signed.jar!/META-INF/jruby.home/lib/ruby/shared/openssl.rb:1
(root) at -e:1
@jeffgran
Copy link
Author

From what I can tell, this is the crucial line:

at org.jruby.RubyModule.defineAnnotatedMethods(RubyModule.java:633)
at org.jruby.ext.openssl.OpenSSLReal.createOpenSSL(OpenSSLReal.java:112)

It looks like it's dynamically defining a new jruby module based on the java code inside OpenSSLReal.java... and that newly defined class is not signed since it didn't exist at compile time? Just guessing based on my limited knowledge of the jruby codebase and java in general...

Any ideas on approaches to how to fix this?

@kares
Copy link
Member

kares commented Sep 6, 2014

expect this to go away in the next release that bundles JOpenSSL >= 0.9.6 (likely JRuby 1.7.16)
... as we're now generating JRuby-OpenSSL invokers in advance.

@jeffgran
Copy link
Author

@kares That's great news! I'll look forward to testing that out when it's available. Thanks for the update.

@jeffgran
Copy link
Author

@kares I was able to verify that JOpenSSL 0.9.6 fixes this issue, by hacking the pom.rb and pom.xml in the latest jruby-1_7 branch to update to 0.9.6.

I hate to be a pest, but is there any chance of releasing a 1.7.x with this upgrade? If not I can of course use my custom-built snapshot jar.

@kares
Copy link
Member

kares commented Jan 22, 2015

@jeffgran glad to hear that ... updating to 0.9.6 for the next 1.7.x release was definitely the plan!

pls, go ahead and open a PR with the pom updated (against jruby-1_7), so that it's not forgotten ...

@jeffgran jeffgran mentioned this issue Jan 22, 2015
Closed
@kares kares closed this as completed Feb 27, 2015
@enebo enebo added this to the JRuby 1.7.20 milestone Apr 28, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
openssl
Projects
None yet
Milestone
JRuby 1.7.20
Development

No branches or pull requests
4 participants
@enebo @mkristian @kares @jeffgran