[MSHADE-147] Failure to shade without explanation when signature is invalid

**[Jesse N. Glick](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=jglick)** opened **[MSHADE-147](https://issues.apache.org/jira/browse/MSHADE-147?redirect=false)** and commented

If there is a signature error in a shaded dependency, you can get a build error like this:

```none
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.apache.maven.plugins:maven-shade-plugin:2.0:shade (shade) on project stuff: Error creating shaded jar: Invalid signature file digest for Manifest main attributes
at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:217)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:153)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:145)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:84)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:59)
at org.apache.maven.lifecycle.internal.LifecycleStarter.singleThreadedBuild(LifecycleStarter.java:183)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:161)
at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:320)
at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:156)
at org.jvnet.hudson.maven3.launcher.Maven3Launcher.main(Maven3Launcher.java:79)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:601)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchStandard(Launcher.java:329)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:239)
at org.jvnet.hudson.maven3.agent.Maven3Main.launch(Maven3Main.java:158)
at hudson.maven.Maven3Builder.call(Maven3Builder.java:100)
at hudson.maven.Maven3Builder.call(Maven3Builder.java:66)
at hudson.remoting.UserRequest.perform(UserRequest.java:118)
at hudson.remoting.UserRequest.perform(UserRequest.java:48)
at hudson.remoting.Request$2.run(Request.java:326)
at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:72)
at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:334)
at java.util.concurrent.FutureTask.run(FutureTask.java:166)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:722)
Caused by: org.apache.maven.plugin.MojoExecutionException: Error creating shaded jar: Invalid signature file digest for Manifest main attributes
at org.apache.maven.plugins.shade.mojo.ShadeMojo.execute(ShadeMojo.java:551)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:101)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:209)
... 27 more
Caused by: java.lang.SecurityException: Invalid signature file digest for Manifest main attributes
at sun.security.util.SignatureFileVerifier.processImpl(SignatureFileVerifier.java:240)
at sun.security.util.SignatureFileVerifier.process(SignatureFileVerifier.java:193)
at java.util.jar.JarVerifier.processEntry(JarVerifier.java:305)
at java.util.jar.JarVerifier.update(JarVerifier.java:216)
at java.util.jar.JarFile.initializeVerifier(JarFile.java:345)
at java.util.jar.JarFile.getInputStream(JarFile.java:412)
at org.apache.maven.plugins.shade.DefaultShader.shade(DefaultShader.java:134)
at org.apache.maven.plugins.shade.mojo.ShadeMojo.execute(ShadeMojo.java:484)
... 29 more
```

Apparently `DefaultShader` is using the `JarFile` constructor that enables signature verification. That may be correct, but if so it should catch `SecurityException` and report the problem more nicely, say with the name of the bad dependency, and perhaps with instructions on how to configure the plugin to ignore this dependency or override the signature check.

Attaching my test project, though I cannot consistently reproduce the problem with this. (Seems to file from inside Jenkins but not outside; not yet sure what the difference would be.)

MSHADE-90 is a bit related.

---

**Affects:** 2.0

**Attachments:**
- [patch.txt](https://issues.apache.org/jira/secure/attachment/12718926/patch.txt) (_4.87 kB_)
- [stuff.zip](https://issues.apache.org/jira/secure/attachment/12718985/stuff.zip) (_3.35 kB_)

**Issue Links:**
- [MSHADE-90](https://issues.apache.org/jira/browse/MSHADE-90) Warn or error for signature files

**Remote Links:**
- [GitHub Pull Request #122
](https://github.com/apache/maven-shade-plugin/pull/122)

2 votes, 7 watchers

Start in DefaultShader, where the stack trace points to signature verification while shading a dependency, and review the attached patch.txt and stuff.zip for the reported scenario. Use the MSHADE-90 link for related behavior; done should include a clearer failure identifying the problematic dependency and guidance for handling the invalid signature.

Written by the indexing model from the issue text.