Why Does My JAR File Throw a 'java.lang.SecurityException: Invalid signature file digest' Error, and How Can I Fix It Using the Maven Shade Plugin?

Understanding the "Invalid Signature File" Error in JAR Execution

When executing a JAR file that utilizes an external library, such as bouncy castle, you may encounter the following error:

Exception in thread "main" java.lang.SecurityException: Invalid signature file digest for Manifest main attributes

To resolve this issue, it's necessary to understand the root cause. This error typically arises when the JAR file contains signature files that are invalid or not recognized by the Java Virtual Machine (JVM).

Solution for Maven-Shade-Plugin Users

For those attempting to create a shaded uber-JAR using the maven-shade-plugin, the solution involves excluding specific signature files from the packaging process. You can achieve this by adding the following lines to your plugin configuration within the POM.xml file:

<filters>
    <filter>
        <artifact>*:*</artifact>
        <excludes>
            <exclude>META-INF/*.SF</exclude>
            <exclude>META-INF/*.DSA</exclude>
            <exclude>META-INF/*.RSA</exclude>
        </excludes>
    </filter>
</filters>

By excluding these specific signature files, you allow the JVM to ignore them during verification, thereby resolving the invalid signature error.

The above is the detailed content of Why Does My JAR File Throw a 'java.lang.SecurityException: Invalid signature file digest' Error, and How Can I Fix It Using the Maven Shade Plugin?. For more information, please follow other related articles on the PHP Chinese website!