How to Fix 'java.lang.SecurityException: Invalid signature file digest' Error in My JAR File?

Resolving Invalid Signature File Error in Jar Execution

Upon attempting to execute a Java program packaged as a .jar, users may encounter the error "java.lang.SecurityException: Invalid signature file digest for Manifest main attributes." This error typically occurs when the .jar utilizes an external library like bouncy castle.

The root cause of this error lies in the signature verification process of the Java Virtual Machine (JVM). The JVM checks the signature of the Manifest file included in the .jar to ensure its authenticity and integrity. However, if the library being used includes its own signature, it can conflict with the JVM's verification process.

One potential solution to this issue particularly relevant to those using maven-shade-plugin to create uber-jars is to exclude signature files from the shading process. By adding the following lines to the plugin configuration, the signature files will be excluded, resolving the error:

<filters>
    <filter>
        <artifact>*:*</artifact>
        <excludes>
            <exclude>META-INF/*.SF</exclude>
            <exclude>META-INF/*.DSA</exclude>
            <exclude>META-INF/*.RSA</exclude>
        </excludes>
    </filter>
</filters>

By excluding signature files from the uber-jar, the conflict with the JVM's verification process is avoided, and the program will execute without the "Invalid signature file" error.

The above is the detailed content of How to Fix 'java.lang.SecurityException: Invalid signature file digest' Error in My JAR File?. For more information, please follow other related articles on the PHP Chinese website!