Unable to use AmazonCorrettoCryptoProvider with GraalVM native-image #177
Labels
help wanted
Extra attention is needed
Comments
lestephane
changed the title
--initialize-at-build-time is in use--initialize-at-build-time is in use
|
Thank you for this report. We really need this thread very early on and create it hear specifically to work around other issues we've encountered by it being lazily created later (and thus descending from some arbitrary other thread in the JVM). I have not experimented with GraalVM nor tested ACCP with it and will pull in some people who know it better to assist me. However, I do see that the error message above recommends using the |
|
What I tried:
I would prefer it if the AWS team provides the GraalVM configuration directly within the artifact, so that only those classes that require special handling are configured as such. |
|
We would certainly appreciate that error. ACCP does lots of static initilization logic to load and configure the native system and supporting resources. I wouldn't really expect anything much more targeted than I agree that we need to further investigate how this library works with GraalVM. At this point we haven't even tested it and so I cannot guarantee that it works. Since we load and use native system libraries I am uncertain how it interacts with precompilation and initialization. |
|
I try my darndest to have GraalVM not initializa the provider at build time: META-INF/native-image/software.amazon.cryptools.AmazonCorrettoCryptoProvider/native-image.propertiesBut I still get the error, without much information about where the instantiation is coming from: What is calling Janitor.register() despite my removing the service loading? |
|
Ah, I see in your module com.amazon.corretto.crypto.provider {
requires java.logging;
exports com.amazon.corretto.crypto.provider;
provides java.security.Provider with com....ServiceProviderFactory; << ---- HERE!!!
}I now tried with and Same error: |
|
latest update (and last one for a while): native-image.propertiesreflect-config.json[
{
"name":"com.amazon.corretto.crypto.provider.AesCtrDrbg$SPI",
"methods":[{"name":"<init>","parameterTypes":[] }]
},
{
"name":"com.amazon.corretto.crypto.provider.AesGcmSpi",
"methods":[{"name":"<init>","parameterTypes":[] }]
},
{
"name":"com.amazon.corretto.crypto.provider.EcGen",
"methods":[{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] }]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpKeyAgreement$DH",
"methods":[{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] }]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpKeyAgreement$ECDH",
"methods":[{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] }]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignatureBase",
"methods":[
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA1withDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA1withECDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA1withRSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA224withDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA224withECDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA224withRSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA256withDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA256withECDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA256withRSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA384withDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA384withECDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA384withRSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA512withDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA512withECDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignature$SHA512withRSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignatureRaw$NONEwithDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.EvpSignatureRaw$NONEwithECDSA",
"methods":[
{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] },
{"name":"setAlgorithmName","parameterTypes":["java.lang.String"] }
]
},
{
"name":"com.amazon.corretto.crypto.provider.HmacMD5Spi",
"methods":[{"name":"<init>","parameterTypes":[] }]
},
{
"name":"com.amazon.corretto.crypto.provider.HmacSHA1Spi",
"methods":[{"name":"<init>","parameterTypes":[] }]
},
{
"name":"com.amazon.corretto.crypto.provider.HmacSHA256Spi",
"methods":[{"name":"<init>","parameterTypes":[] }]
},
{
"name":"com.amazon.corretto.crypto.provider.HmacSHA384Spi",
"methods":[{"name":"<init>","parameterTypes":[] }]
},
{
"name":"com.amazon.corretto.crypto.provider.HmacSHA512Spi",
"methods":[{"name":"<init>","parameterTypes":[] }]
},
{
"name":"com.amazon.corretto.crypto.provider.MD5Spi",
"methods":[{"name":"<init>","parameterTypes":[] }]
},
{
"name":"com.amazon.corretto.crypto.provider.RsaCipher$NoPadding",
"methods":[{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] }]
},
{
"name":"com.amazon.corretto.crypto.provider.RsaCipher$OAEPSha1",
"methods":[{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] }]
},
{
"name":"com.amazon.corretto.crypto.provider.RsaCipher$Pkcs1",
"methods":[{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] }]
},
{
"name":"com.amazon.corretto.crypto.provider.RsaGen",
"methods":[{"name":"<init>","parameterTypes":["com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider"] }]
},
{
"name":"com.amazon.corretto.crypto.provider.SHA1Spi",
"methods":[{"name":"<init>","parameterTypes":[] }]
},
{
"name":"com.amazon.corretto.crypto.provider.SHA256Spi",
"methods":[{"name":"<init>","parameterTypes":[] }]
},
{
"name":"com.amazon.corretto.crypto.provider.SHA384Spi",
"methods":[{"name":"<init>","parameterTypes":[] }]
},
{
"name":"com.amazon.corretto.crypto.provider.SHA512Spi",
"methods":[{"name":"<init>","parameterTypes":[] }]
}
]resource-config.json{
"resources":{
"includes":[
{
"pattern":"\\Qcom/amazon/corretto/crypto/provider/libamazonCorrettoCryptoProvider.so\\E"
},
{
"pattern":"\\Qcom/amazon/corretto/crypto/provider/testdata/ctr-drbg.txt\\E"
},
{
"pattern":"\\Qcom/amazon/corretto/crypto/provider/testdata/hmac.txt\\E"
},
{
"pattern":"\\Qcom/amazon/corretto/crypto/provider/version.properties\\E"
}
]},
"bundles":[]
}build.gradle.ktsThis strips the signatures from your artifact, so that GraalVM may consume the config jsons above from another part of the classpath without SecurityException. If you add the config json files above to the META-INF/native-image of your project, this won't be necessary anymore. plugins {
...
id("org.graalvm.buildtools.native")
}
dependencies {
api("software.amazon.cryptools:AmazonCorrettoCryptoProvider:1.+:linux-x86_64")
}
tasks.jar {
println("creating crypto jar without signatures")
from(configurations.compileClasspath.get().map {
if (it.isDirectory) { it } else { zipTree(it) }) {
exclude("META-INF/*.SF")
exclude("META-INF/*.DSA")
exclude("META-INF/*.RSA")
exclude("META-INF/module-info.class") // prevent service loading
exclude("META-INF/services/*") // prevent service loading
}
}
graalvmNative {
binaries {
named("main") {
sharedLibrary.set(false)
mainClass.set("repro.InstallKt")
buildArgs(
"--no-fallback",
"-H:+ReportExceptionStackTraces",
"-H:+ReportUnsupportedElementsAtRuntime",
"--allow-incomplete-classpath",
)
jvmArgs.add("-verbose:class")
}
}
}repro.InstallKtjava.security (in JAVA_HOME)taken from your project ResultI've spent all the time I'll be able to spare on this problem. In the end, Amazon is better placed to make the provider plug and play for GraalVM, which will help a lot of people. |
lestephane
changed the title
--initialize-at-build-time is in use
|
Absolutely. The solution to something like this should rest with us. Thank you so much for the work and research you did above. I'm sorry that the solution wasn't something quick and easy. We hear the need for this and will try to get some eyes on it. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
As recommended in the configuration section, I call as early as possible, in my application main entry point,
com.amazon.corretto.crypto.provider.AmazonCorrettoCryptoProvider.install().But, if I then use
--initialize-at-build-timewith GraalVM'snative-image, it complains that ajava.lang.Threadis created as a side-effect of callinginstall().The cascade of class initializations goes as follows
install()is called onAmazonCorrettoCryptoProvider...com.amazon.corretto.crypto.provider.LoaderatAmazonCorrettoCryptoProvider:47(v 1.6.1)JanitoratLoader:185Janitor:319Is there a way to initialize as much as possible of the provider without creating this thread?
Amazon started adding GraalVM configuration files in SDK libraries. Maybe it's time to do the same for
AmazonCorrettoCryptoProvider. In any case, any advice is welcome.The text was updated successfully, but these errors were encountered: