Bug 465636 – dev-java/bcprov: Signature issues prevent depending applications from using it

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Dennis Schridde 2013-04-12 08:19:04 UTC]

From wrapper.log:
INFO   | jvm 1    | 2013/04/12 10:09:55 | SERIOUS PROBLEM: Unable to load or use BouncyCastle provider.
INFO   | jvm 1    | 2013/04/12 10:09:55 | java.lang.Error: Cannot use required algorithm from BouncyCaste provider
INFO   | jvm 1    | 2013/04/12 10:09:55 |       at freenet.crypt.JceLoader$BouncyCastleLoader.load(JceLoader.java:82)
INFO   | jvm 1    | 2013/04/12 10:09:55 |       at freenet.crypt.JceLoader$BouncyCastleLoader.access$300(JceLoader.java:61)
INFO   | jvm 1    | 2013/04/12 10:09:55 |       at freenet.crypt.JceLoader.<clinit>(JceLoader.java:48)
INFO   | jvm 1    | 2013/04/12 10:09:55 |       at freenet.node.NodeStarter.<init>(NodeStarter.java:73)
INFO   | jvm 1    | 2013/04/12 10:09:55 |       at freenet.node.NodeStarter.main(NodeStarter.java:261)
INFO   | jvm 1    | 2013/04/12 10:09:55 | Caused by: java.lang.SecurityException: JCE cannot authenticate the provider BC
INFO   | jvm 1    | 2013/04/12 10:09:55 |       at javax.crypto.SunJCE_b.a(DashoA13*..)
INFO   | jvm 1    | 2013/04/12 10:09:55 |       at javax.crypto.KeyAgreement.getInstance(DashoA13*..)
INFO   | jvm 1    | 2013/04/12 10:09:55 |       at freenet.crypt.JceLoader$BouncyCastleLoader.load(JceLoader.java:79)
INFO   | jvm 1    | 2013/04/12 10:09:55 |       ... 4 more
INFO   | jvm 1    | 2013/04/12 10:09:55 | Caused by: java.util.jar.JarException: Cannot parse file:/usr/share/bcprov/lib/bcprov.jar
INFO   | jvm 1    | 2013/04/12 10:09:55 |       at javax.crypto.SunJCE_c.a(DashoA13*..)
INFO   | jvm 1    | 2013/04/12 10:09:55 |       at javax.crypto.SunJCE_b.b(DashoA13*..)
INFO   | jvm 1    | 2013/04/12 10:09:55 |       at javax.crypto.SunJCE_b.a(DashoA13*..)
INFO   | jvm 1    | 2013/04/12 10:09:55 |       ... 7 more
INFO   | jvm 1    | 2013/04/12 10:09:55 | BouncyCastle: null
INFO   | jvm 1    | 2013/04/12 10:09:55 | SunPKCS11-NSS: null
INFO   | jvm 1    | 2013/04/12 10:09:55 | SUN: SUN version 1.6
INFO   | jvm 1    | 2013/04/12 10:09:55 | SunJCE: SunJCE version 1.6

emerge --info: attachment #345232 [details]

[binary   R   *] dev-java/bcprov-1.45  USE="-doc -source" 0 kB
[binary   R   *] dev-java/sun-jdk-1.6.0.43:1.6  USE="jce pax_kernel -X -alsa -derby -doc -examples (-nsplugin) -source" 0 kB
[binary   R   *] net-p2p/freenet-0.7.5_p1440  USE="-doc -source {-test}" 0 kB

[Comment 1 Arne Babenhauserheide 2013-04-12 09:17:28 UTC]

I assume that BouncyCastle provides signed jars, but you don’t have the necessary verification keys

I have no clue how to fix that, though… 

BouncyCastle gives new Freenet versions more advanced full strength crypto routines.

[Comment 2 Dennis Schridde 2013-04-12 09:43:07 UTC]

Created attachment 345346 [details]
manifest.mf (sunjce_provider.jar)

I detected a difference between the manifest.mf in sunjce_provider.jar and the one in bcprov.jar.

This is Sun's manifest for comparison.

[Comment 3 Dennis Schridde 2013-04-12 09:43:52 UTC]

Created attachment 345348 [details]
manifest.mf (bcprov.jar)

This bouncycastle's manifest.

[Comment 4 Dennis Schridde 2013-04-12 10:25:11 UTC]

The issue seems to be signing, indeed. I downloaded the latest signed jar from http://www.bouncycastle.org/latest_releases.html and now it works.

Maybe the ebuild should sign the created jar using an own key and then install that key into the jvm's trusted keys list?

[Comment 5 Thomas Sachau 2013-05-24 20:16:48 UTC]

For your problem: The signing issue seems to happen randomly with different java providers, but i have not been able to reproduce it.

I myself had it once, played a bit with java providers and the issue vanished. So without a proper way to reproduce it, not much anyone can do.

Also: This is no freenet issue, but instead an issue of the bouncycastle package, since the signature there does have issues sometimes, so i will change the title accordingly.

[Comment 6 Dennis Schridde 2013-09-01 07:25:17 UTC]

Persists with bcprov-1.49:
java.lang.Error: Cannot use required algorithm from BouncyCaste provider
      at freenet.crypt.JceLoader$BouncyCastleLoader.load(JceLoader.java:82)
      at freenet.crypt.JceLoader$BouncyCastleLoader.access$300(JceLoader.java:61)
      at freenet.crypt.JceLoader.<clinit>(JceLoader.java:48)
      at freenet.node.NodeStarter.<init>(NodeStarter.java:75)
      at freenet.node.NodeStarter.main(NodeStarter.java:263)
Caused by: java.lang.SecurityException: JCE cannot authenticate the provider BC
      at javax.crypto.SunJCE_b.a(DashoA13*..)
      at javax.crypto.KeyAgreement.getInstance(DashoA13*..)
      at freenet.crypt.JceLoader$BouncyCastleLoader.load(JceLoader.java:79)
      ... 4 more
Caused by: java.util.jar.JarException: Cannot parse file:/usr/share/bcprov/lib/bcprov.jar
      at javax.crypto.SunJCE_c.a(DashoA13*..)
      at javax.crypto.SunJCE_b.b(DashoA13*..)
      at javax.crypto.SunJCE_b.a(DashoA13*..)
      ... 7 more

Using the official JAR instead made it work: http://www.bouncycastle.org/download/bcprov-jdk15on-149.jar

For me the issue appears every time I try to use the Gentoo JAR. I am on ia64 with dev-java/sun-jdk-1.6.0.45.

[Comment 7 Tom Wijsman (TomWij) (RETIRED) 2014-02-06 14:01:20 UTC]

bcprov-1.50 will be on the mirrors in a few hours; could you try this new version, as well as a more recent JDK (sun-jdk is masked and thus no longer supported) to see whether this bug still can be reproduced on newer versions?

Thank you very much in advance.

[Comment 8 Patrice Clement 2015-07-07 12:58:40 UTC]

Marking as FIXED.