Re: [jgit-dev] SecurityException using latest self-contained executable

[Bo Shi <bs1984@xxxxxxxxx>]

Thanks Mathias.  Building the self-contained binary from source was also very striaght forward.

On Tue, Sep 24, 2013 at 12:22 AM, Matthias Sohn <matthias.sohn@xxxxxxxxx> wrote:

On Mon, Sep 23, 2013 at 3:03 PM, Matthias Sohn <matthias.sohn@xxxxxxxxx> wrote:

On Fri, Sep 20, 2013 at 11:33 PM, Bo Shi <bs1984@xxxxxxxxx> wrote:

Sorry if this is not the right place to report this issue.  I'm having trouble running the latest official self-contained executable on OSX:

tmp $ java -version

java version "1.6.0_51"

Java(TM) SE Runtime Environment (build 1.6.0_51-b11-457-11M4509)

Java HotSpot(TM) 64-Bit Server VM (build 20.51-b01-457, mixed mode)

tmp $ wget https://repo.eclipse.org/content/groups/releases//org/eclipse/jgit/org.eclipse.jgit.pgm/3.0.3.201309161630-r/org.eclipse.jgit.pgm-3.0.3.201309161630-r.sh

--2013-09-20 14:27:46--  https://repo.eclipse.org/content/groups/releases//org/eclipse/jgit/org.eclipse.jgit.pgm/3.0.3.201309161630-r/org.eclipse.jgit.pgm-3.0.3.201309161630-r.sh

Resolving repo.eclipse.org (repo.eclipse.org)... 198.41.30.233

Connecting to repo.eclipse.org (repo.eclipse.org)|198.41.30.233|:443... connected.

HTTP request sent, awaiting response... 200 OK

Length: 2665376 (2.5M) [application/x-shar]

Saving to: ‘org.eclipse.jgit.pgm-3.0.3.201309161630-r.sh’

100%[===============================================================================>] 2,665,376   1.67MB/s   in 1.5s

2013-09-20 14:27:48 (1.67 MB/s) - ‘org.eclipse.jgit.pgm-3.0.3.201309161630-r.sh’ saved [2665376/2665376]

tmp $ sh org.eclipse.jgit.pgm-3.0.3.201309161630-r.sh -h

Exception in thread "main" java.lang.SecurityException: Invalid signature file digest for Manifest main attributes

at sun.security.util.SignatureFileVerifier.processImpl(SignatureFileVerifier.java:219)

at sun.security.util.SignatureFileVerifier.process(SignatureFileVerifier.java:174)

at java.util.jar.JarVerifier.processEntry(JarVerifier.java:288)

at java.util.jar.JarVerifier.update(JarVerifier.java:199)

at java.util.jar.JarFile.initializeVerifier(JarFile.java:327)

at java.util.jar.JarFile.getInputStream(JarFile.java:395)

at sun.misc.URLClassPath$JarLoader$2.getInputStream(URLClassPath.java:708)

at sun.misc.Resource.cachedInputStream(Resource.java:61)

at sun.misc.Resource.getByteBuffer(Resource.java:144)

at java.net.URLClassLoader.defineClass(URLClassLoader.java:256)

at java.net.URLClassLoader.access$000(URLClassLoader.java:58)

at java.net.URLClassLoader$1.run(URLClassLoader.java:197)

at java.security.AccessController.doPrivileged(Native Method)

at java.net.URLClassLoader.findClass(URLClassLoader.java:190)

at java.lang.ClassLoader.loadClass(ClassLoader.java:306)

at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:301)

at java.lang.ClassLoader.loadClass(ClassLoader.java:247)

this was broken by the move to use the new signing plugin.

As a workaround download the jars

https://repo.eclipse.org/content/unzip/releases.unzip/org/eclipse/jgit/org.eclipse.jgit.repository/3.0.3.201309161630-r/org.eclipse.jgit.repository-3.0.3.201309161630-r.zip-unzip/plugins/com.jcraft.jsch_0.1.46.v201205102330.jar

https://repo.eclipse.org/content/unzip/releases.unzip/org/eclipse/jgit/org.eclipse.jgit.repository/3.0.3.201309161630-r/org.eclipse.jgit.repository-3.0.3.201309161630-r.zip-unzip/plugins/javaewah_0.5.6.v201307211000.jar

https://repo.eclipse.org/content/unzip/releases.unzip/org/eclipse/jgit/org.eclipse.jgit.repository/3.0.3.201309161630-r/org.eclipse.jgit.repository-3.0.3.201309161630-r.zip-unzip/plugins/org.apache.commons.compress_1.4.1.v201301140946.jar

https://repo.eclipse.org/content/unzip/releases.unzip/org/eclipse/jgit/org.eclipse.jgit.repository/3.0.3.201309161630-r/org.eclipse.jgit.repository-3.0.3.201309161630-r.zip-unzip/plugins/org.eclipse.jgit.pgm_3.0.3.201309161630-r.jar

https://repo.eclipse.org/content/unzip/releases.unzip/org/eclipse/jgit/org.eclipse.jgit.repository/3.0.3.201309161630-r/org.eclipse.jgit.repository-3.0.3.201309161630-r.zip-unzip/plugins/org.eclipse.jgit.ui_3.0.3.201309161630-r.jar

https://repo.eclipse.org/content/unzip/releases.unzip/org/eclipse/jgit/org.eclipse.jgit.repository/3.0.3.201309161630-r/org.eclipse.jgit.repository-3.0.3.201309161630-r.zip-unzip/plugins/org.eclipse.jgit_3.0.3.201309161630-r.jar

https://repo.eclipse.org/content/unzip/releases.unzip/org/eclipse/jgit/org.eclipse.jgit.repository/3.0.3.201309161630-r/org.eclipse.jgit.repository-3.0.3.201309161630-r.zip-unzip/plugins/org.kohsuke.args4j_2.0.21.v201301150030.jar

into one directory, copy the shell script

http://git.eclipse.org/c/jgit/jgit.git/plain/org.eclipse.jgit.pgm/jgit.sh?id=v3.0.3.201309161630-r

to the same folder make it executable (chmod +x jgit.sh)

set the environment variable JGIT_CLASSPATH to the directory containing all these jars:

e.g. export JGIT_CLASSPATH=/path/to/jgit/jars/*

and run jgit.sh

Proposed fix for this problem https://git.eclipse.org/r/#/c/16711/ 

--

Matthias

--
Bo Shi
617-942-1744