funcool/buddy-core

SecurityException on startup

Closed this issue · 5 comments

tuhlmann commented

I just switch from 0.13.0 to 1.0.0 and see now the following exception when doing lein repl:

Exception in thread "main" java.lang.ExceptionInInitializerError
    at clojure.main.<clinit>(main.java:20)
Caused by: java.lang.SecurityException: class "org.bouncycastle.crypto.digests.SHA3Digest"'s signer information does not match signer information of other classes in the same package, compiling:(buddy/core/hash.clj:1:1)

Here's the list of buddy libraries I'm using:

  • [buddy/buddy-core "1.0.0"]
  • [buddy/buddy-sign "1.2.0"]
  • [buddy/buddy-hashers "1.0.0"]
  • [buddy/buddy-auth "1.2.0"]

My clojure version is 1.8.0. Reverting buddy-core to 0.13.0 solves the problem.

PS: Thanks for the great work you're doing!

niwinz commented

Seems like it does not related to buddy itself. Maybe you have compiled classes of old version of bouncycastle in your classpath. Try cleaning the target directory... an other possible issue can be AOT that is highly discouraged because is very prone to this kind of errors.

tuhlmann commented

@niwinz Thanks for the quick response!

I did a lein clean which remove the target directory (is there any other place the would hold build artifacts?) and don't use aot (only for the uberjar task which I don't use here), still lein repl fails (the repl is not opened).

tuhlmann commented

The problem also occurs if I remove buddy-core at all from the deps list. Maybe its loaded as a dependency of another library I'm using and this creates the mismatch?

niwinz commented

Yes, this is also a possible cause. Can you paste the result of lein deps :tree somewhere?

tuhlmann commented

I found the problem:

I'm using flyingsaucer in my project which comes with an older version of bouncycastle. buddy-core 0.13.0 already had a new version than bc but it seems the key they were signed with was the same. Now they might have changed keys.

Using this exclusion in project.clj I get it back to work:

[org.xhtmlrenderer/flying-saucer-pdf "9.0.9" :exclusions [bouncycastle/bcprov-jdk14]]

Thanks. May this serve as documentation in case someone else runs into this problem.

  • 👍3