Skip to content

Signed jar verification fails when nested in an uber war running on an Oracle JVM #47284

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Signed jar verification fails when nested in an uber war running on an Oracle JVM #47284

wants to merge 1 commit into from

Conversation

DKARAGODIN
Copy link

There is an issue with spring boot app as fat Jar that runs on Oracle JVM and uses third-party crypto libraries.

#28837

The hacked solution committed 33c5e12 is relevant to this day because ZipFile.getManifestName(onlyIfSignatureRelatedFiles) stays private. But this hacked solution only works for uber Jar.

In this PR I extend this hack to uber War.

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Sep 19, 2025
@wilkinsona wilkinsona changed the title Write signature files to uber wars for Oracle Java 17 verification Signed jar verification fails when nested in an uber war running on an Oracle JVM Sep 22, 2025
@wilkinsona wilkinsona added type: bug A general bug and removed status: waiting-for-triage An issue we've not yet triaged labels Sep 22, 2025
@wilkinsona wilkinsona added this to the 3.4.x milestone Sep 22, 2025
@wilkinsona
Copy link
Member

Thanks for the PR. Could you please add some tests on the Gradle side, similar to those that were added in 33c5e12. It may be possible to move BootJarIntegrationTests::signed up into AbstractBootArchiveIntegrationTests.

@wilkinsona wilkinsona added the status: waiting-for-feedback We need additional information before we can continue label Sep 22, 2025
@DKARAGODIN
Copy link
Author

Thanks for the PR. Could you please add some tests on the Gradle side, similar to those that were added in 33c5e12. It may be possible to move BootJarIntegrationTests::signed up into AbstractBootArchiveIntegrationTests.

Done.

Also deleted field BootZipCopyAction#supportsSignatureFile since it was used to distinguish between jar and war build in gradle.

@spring-projects-issues spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Sep 22, 2025
wilkinsona
wilkinsona requested changes Sep 22, 2025
View reviewed changes
Copy link
Member

@wilkinsona wilkinsona left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the updates. I think there's one more tweak that could be made.

...java/org/springframework/boot/gradle/tasks/bundling/AbstractBootArchiveIntegrationTests.java Outdated
}

protected void signed(String bundling) throws IOException {
assertThat(this.gradleBuild.build(bundling).task(":" + bundling).getOutcome()).isEqualTo(TaskOutcome.SUCCESS);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can use this.taskName here instead of bundling and further simplify the sub-classes.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

Deleted tests in sub-classes.

@DKARAGODIN DKARAGODIN force-pushed the gh-28837 branch 2 times, most recently from 40533cb to c21d083 Compare September 24, 2025 09:37
@DKARAGODIN
Copy link
Author

DKARAGODIN commented Sep 24, 2025 •
edited by wilkinsona
Loading

Fixed merge conflicts introduced by bc46bb2.

@DKARAGODIN
Write signature files to uber wars for Oracle Java 17 verification
73a2c82 
This commit extends 33c5e12 to uber War.

Fixes spring-projectsgh-28837

Signed-off-by: Dmitrii Karagodin <[email protected]>
@DKARAGODIN
Copy link
Author

Fixed merge conflicts introduced by 44099d3.

@DKARAGODIN
Copy link
Author

Do I need to do something for this PR to be merged and included in 3.5.7?

@wilkinsona
Copy link
Member

No, there's nothing you need to do. We're focusing pretty heavily on 4.0.0-RC1 at the moment so this change may not make it into this month's maintenance releases. Thanks for your patience in the meantime.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@wilkinsona wilkinsona Awaiting requested review from wilkinsona

Assignees
No one assigned
Labels
status: feedback-provided Feedback has been provided type: bug A general bug
Projects
None yet
Milestone
3.4.x
Development

Successfully merging this pull request may close these issues.
3 participants
@DKARAGODIN @wilkinsona @spring-projects-issues