java.lang.SecurityException: no manifest section for signature file entry

Question

I have tried suggestions in other threads but they don\'t help me. When I run my jar by java -jar -BigJar.jar I receive exception :

Exception in t

Answer 1

This error message tells exactly why bundled jar is not recommended for production release. The problem is some of your dependency jar is signed with signature files. repack it may violate some security policy on the dependency jar.

To make it work, you need remove all signature files from the signed jar, before copying the unpacked files into your final build jar file.

<plugin>
   <groupId>org.apache.maven.plugins</groupId>
   <artifactId>maven-shade-plugin</artifactId>
   <executions>
      <execution>
         <phase>package</phase>
            <goals>
               <goal>shade</goal>
            </goals>
      </execution>
   </executions>
   <configuration>
      <finalName>${project.artifactId}-${project.version}-uber</finalName>
      <filters>
         <filter>
            <artifact>*:*</artifact>
               <excludes>
                  <exclude>META-INF/*.SF</exclude>
                  <exclude>META-INF/*.DSA</exclude>
                  <exclude>META-INF/*.RSA</exclude>
               </excludes>
            </filter>
         </filters>
   </configuration>
</plugin>

Answer 2

It seems like you might be inlcuding the jars twice. First with the zipgroupfilesets and then again with a series of zipfilesets.

You could probably remove the zipgroupfilesets.

I believe there is also a problem in your excludes. You could change it to this:

<zipfileset src="contrib/fissuresUtil-1.0.18.jar">
    <exclude name="**/*.RSA" />
    <exclude name="**/*.SF" />
    <exclude name="**/*.DSA" />
</zipfileset>

Or this:

<zipfileset src="contrib/fissuresUtil-1.0.18.jar" excludes="**/*.RSA,**/*.SF,**/*.DSA"/>

See http://ant.apache.org/manual/Types/fileset.html (zipfileset is a form of fileset) for more information on that.

On another note, something like this might simplify things a bit:

<jar destfile="SwarmMentics.jar" manifest="lib/MANIFEST.MF">
    <restrict>
        <not>
            <or>
                <name name="**/*.RSA"/>
                <name name="**/*.SF"/>
                <name name="**/*.DSA"/>
            </or>
        </not>
        <archives>
            <zips>
                <fileset dir="contrib" includes="**/*.jar"/>
                <fileset dir="lib" includes="**/*.jar"/>
            </zips>
        </archives>
    </restrict>
</jar>

I adapted this from the example at http://ant.apache.org/manual/Tasks/jar.html under the "Merging archives" section.

Answer 3

Just delete the *.SF file in your imported signed jar (in meta_inf folder)