maven shade plugin: Invalid signature file digest for Manifest main attributes

解决Maven Shade Plugin中Invalid Signature错误

最新推荐文章于 2025-03-13 19:32:28 发布

原创最新推荐文章于 2025-03-13 19:32:28 发布 · 544 阅读

2 ·

CC 4.0 BY-SA版权

文章标签：

#java

Maven 专栏收录该内容

14 篇文章

订阅专栏

本文详细解释了如何在pom.xml文件中配置Maven Shade Plugin以解决Invalid signature错误，涉及到JAR文件签名验证和使用jarsigner工具的相关知识。

源：http://zhentao-li.blogspot.com/2012/06/maven-shade-plugin-invalid-signature.html
评；
If you get the following error message with maven shade plugin:

Exception in thread "main" java.lang.SecurityException: Invalid signature file digest for Manifest main attributes

You need to add the following to pom.xml:

<configuration>
<filters>
<filter>
<artifact>*:*</artifact>
<excludes>
<exclude>META-INF/*.SF</exclude>
<exclude>META-INF/*.DSA</exclude>
<exclude>META-INF/*.RSA</exclude>
</excludes>
</filter>
</filters>
</configuration>

Explanation:

The above configuration filters all files in META-INF ending with .SF, .DSA, and .RSA for all artifacts (*:*) when creating uber-jar file.

The reason java.lang.SecurityException is raised is because some dependency jar files are signed jar files. A jar file is signed by using jarsigner, which creates 2 additional files and places them in META-INF:
a signature file, with a .SF extension, and
a signature block file, with a .DSA, .RSA, or .EC extension.
Since the uber-jar file is created, the signatures and integrity of signed JAR files are no longer valid. When the uber-jar file is executed, java.lang.SecurityException is thrown.

See jarsigner for detailed explanation of JAR Signing and Verification Tool.