Building an image with conscrypt included throws an VMError (Image heap writing found a class not seen during static analysis) #6793

SergejIsbrecht · 2023-06-14T10:07:29Z

Describe the issue
Trying to build a native-image with conscrypt (https://github.com/google/conscrypt) included.

Steps to reproduce the issue

Checkout https://github.com/SergejIsbrecht/graalvm_conscrypt
follow README.md instructions in Repo

Describe GraalVM and your environment:

GraalVM version: GraalVM CE 23.0.0
JDK major version: 17
OS: Ubuntu
Architecture: amd64

More details

Using following settings (see repository example) will result in an Error when generating an native-image with GraalVM CE native-image 23.0. With GraalVM CE 22.3.x the generation of the native-image succeeds without any issue.

                    "--initialize-at-build-time=org.conscrypt.EvpMdRef\$SHA256,org.conscrypt.EvpMdRef\$SHA1",
                    "--initialize-at-build-time=org.conscrypt.Platform,org.conscrypt.OpenSSLProvider,org.conscrypt.NativeCrypto,org.conscrypt.NativeLibraryLoader,org.conscrypt.HostProperties",

The build process encountered an unexpected error:

> com.oracle.svm.core.util.VMError$HostedError: com.oracle.svm.core.util.UserError$UserException: Image heap writing found a class not seen during static analysis. Did a static field or an object referenced from a static field change during native image generation? For example, a lazily initialized cache could have been initialized during image generation, in which case you need to force eager initialization of the cache before static analysis or reset the cache using a field value recomputation.
    class: sun.security.x509.X509CertImpl
  reachable through:
    object: [
[
  Version: V3
  Subject: CN=JCE Code Signing CA, OU=Java Software Code Signing, O=Oracle Corporation
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 2048 bits
  params: null
  modulus: 17055452969822851135992683666979143033468417516051484609876299349676029392164762036831549416422250468242904965674236843772803293403274674367639000027597291165980354342488221481381151536971801625301661816742720339832977615327173058869536881152822978061111237825033757212550660110223240010192057280048506749054109628485658743646473290297361365307075301733147631825944967519762063418196630025286099013201124619373211156022657615904486255757509163698183415752543095397597179195207723060703818084876590178940763595648511724817319040693751004044340989968966872349969442926398888123828596921098899758812235847574184576447233
  public exponent: 65537
  Validity: [From: Thu Jul 07 01:48:44 CEST 2016,
               To: Tue Dec 31 01:00:00 CET 2030]
  Issuer: CN=JCE Code Signing CA, OU=Java Software Code Signing, O=Oracle Corporation
  SerialNumber: [    3c9eb1fc 89f733d3]

Certificate Extensions: 4
[1]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 59 D5 01 84 D3 02 3B 8D   41 97 46 97 E7 A5 51 07  Y.....;.A.F...Q.
0010: BC 6C 20 2B                                        .l +
]
]

[2]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:0
]

[3]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_CertSign
  Crl_Sign
]

[4]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 59 D5 01 84 D3 02 3B 8D   41 97 46 97 E7 A5 51 07  Y.....;.A.F...Q.
0010: BC 6C 20 2B                                        .l +
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 3F 13 7F D7 C2 40 E8 1E   CE 79 86 10 6B 92 B7 FB  [email protected]...
0010: 6B D5 C0 56 0C 11 3A 84   CC 28 97 BE C8 96 A0 6C  k..V..:..(.....l
0020: 7A 7B B2 D2 62 23 25 A4   24 30 0E 86 32 CF 69 EE  z...b#%.$0..2.i.
0030: 50 1D DB 6F 51 00 D6 8D   14 89 AC AF FF 3B 93 18  P..oQ........;..
0040: B8 E3 A1 AD 70 B5 3C 79   1B EE 22 83 A5 7E 6A 19  ....p.<y.."...j.
0050: 7F 57 A6 C6 4D 3E 9D 86   80 DE 54 C5 00 A5 B9 6D  .W..M>....T....m
0060: 3C A2 7C 79 B4 98 35 1A   19 1D B8 E4 21 E8 0D D6  <..y..5.....!...
0070: 62 40 F6 11 3E 3A 97 ED   D8 FF 6B 69 3F CC 24 9C  b@..>:....ki?.$.
0080: 63 75 51 8F FD DE A9 2C   14 14 BB FB 50 EF FF 1F  cuQ....,....P...
0090: B0 42 2D 17 34 A3 14 43   94 C2 C5 C3 F6 4C 3C CD  .B-.4..C.....L<.
00A0: 35 4E 16 28 28 DF A6 43   B4 CB 8C 30 76 AC F8 5B  5N.((..C...0v..[
00B0: 6A BE 31 00 1D 43 79 5A   27 0E D8 7C 1E 50 53 4E  j.1..CyZ'....PSN
00C0: CA 26 68 26 41 9D C9 C5   BF 55 70 45 F7 57 B5 15  .&h&A....UpE.W..
00D0: B8 31 6F 79 DA 3D B6 7F   39 48 AF 95 44 E8 16 32  .1oy.=..9H..D..2
00E0: 02 48 B0 E5 AB C4 F1 11   A3 61 21 0E C1 D4 9C 70  .H.......a!....p
00F0: C6 75 B7 BD 6A 2B 46 61   5E 94 C8 38 69 03 5A C0  .u..j+Fa^..8i.Z.

]  of class: sun.security.x509.X509CertImpl
    object: [Ljava.lang.Object;@49bb647f  of class: java.lang.Object[]
    object: com.oracle.svm.core.code.ImageCodeInfo@41ccb3b9  of class: com.oracle.svm.core.code.ImageCodeInfo
    root: com.oracle.svm.core.code.ImageCodeInfo.prepareCodeInfo()

Is there any guidance what I should do in such cases?

The text was updated successfully, but these errors were encountered:

koutheir · 2023-06-14T21:22:59Z

Two objects of the class sun.security.x509.X509CertImpl are referenced by the ImageCodeInfo.frameInfoObjectConstants object array, which is referenced by com.oracle.svm.core.code.ImageCodeInfo.prepareCodeInfo().

The two X509CertImpl objects are returned from org.conscrypt.NativeCryptoJni.class.getSigners() and included (indirectly, after some processing) in the com.oracle.svm.core.code.ImageCodeInfo.frameInfoObjectConstants array by the method com.oracle.svm.hosted.reflect.ReflectionMetadataEncoderImpl.addClassMetadata().

The archive conscrypt-openjdk-uber-2.5.2.jar holds a META-INFO/MANIFEST.MF containing:

Name: org/conscrypt/NativeCryptoJni.class
SHA-256-Digest: ly/K0/AVLxNxmFXMLYhNeWEQeBzs0fzPLsZnDS45G1E=

And the archive also contains the two X.509 certificates, loaded into the two X509CertImpl objects, in the file META-INFO/SIGNINGC.RSA.

koutheir · 2023-06-14T22:11:06Z

@loicottet, I believe the changes relative to this new behavior were introduced in this commit. Do you think this new behavior introduced a regression?

loicottet · 2023-06-20T11:35:23Z

This commit introduced reflective access to signers in Native Image, so it is possible that the issue comes from here. What looks strange to me is that there are no signers registered in the reflect-config.json file of the reproducer. I will look into it.

msupic · 2023-07-06T14:45:54Z

I have the same issue with Bouncy Castle when using GraalVM CE 17.0.7+7.1

SergejIsbrecht · 2023-11-14T15:11:34Z

@loicottet, did you make any progress on this? It seems other place on the internet have the same issue (quick google search). I tried it with the latest / greatest Oracle GraalVM and the issue still persists.

Just FYI, if I were to remove the signer entries from the META-INF/MANIFEST.MF, the generation is successful with 23.0 as well.

META-INF/MANIFEST.MF

Name: org/conscrypt/ConscryptCertStore.class
SHA-256-Digest: IvVp23Y7HX5EpUpQhoh/EE90eBKFQlTMDsbZVzaYW/4=

Name: org/conscrypt/OpenSSLMac$HmacSHA1.class
SHA-256-Digest: oH6h4N4UU08DQ0cxffN1fddLZXb46QWe4FR+FqEDzZY=

...

META-INF/MANIFEST.MF

Manifest-Version: 1.0
Implementation-Title: conscrypt-openjdk-uber
Automatic-Module-Name: org.conscrypt
Target-Compatibility: 1.7
Bundle-SymbolicName: org.conscrypt
Implementation-Version: 2.5.2
BoringSSL-Version: 49f0329110a1d93a5febc2bceceedc655d995420
Built-By: root
Bnd-LastModified: 1617109637399
Bundle-ManifestVersion: 2
Import-Package: javax.crypto,javax.crypto.spec,javax.net,javax.net.ssl
 ,javax.security.auth.x500,javax.security.cert,org.conscrypt,org.consc
 rypt.ct,org.conscrypt.io,sun.security.x509
Require-Capability: osgi.ee;filter:="(&(osgi.ee=JavaSE)(version=1.7))"
Built-JDK: 1.8.0_131
Tool: Bnd-4.3.0.201909301554
Export-Package: org.conscrypt;uses:="javax.crypto,javax.net.ssl,javax.
 security.auth.x500,org.conscrypt.ct";version="2.5.2",org.conscrypt.ct
 ;uses:="org.conscrypt";version="2.5.2",org.conscrypt.io;version="2.5.
 2"
Bundle-Name: org.conscrypt
Bundle-Version: 2.5.2
Source-Compatibility: 1.7
Created-By: 1.8.0_131 (Oracle Corporation)

and remove /META-INF/SIGNINGC.SF and SIGNINGC.RSA

repackage with

jar cmf META-INF/MANIFEST.MF ../edited.conscrypt.jar *

OpenSpaghettiSauce · 2023-11-19T15:28:27Z

Not sure if my issue is related. I want to use the native-image.cmd to compile a project but I keep getting:

> com.oracle.svm.core.util.VMError$HostedError: com.oracle.graal.pointsto.util.AnalysisError$TypeNotFoundError: Type not found during analysis: HotSpotType<Lsun/security/x509/X509CertImpl;, resolved>

Of course I tried looking around files that could have this dependency, but no dice. I tried both 21.0.1 and 17.0.9 but no luck.

loicottet · 2023-11-21T14:35:50Z

This is caused by the fact that signers are mistakenly included in the image even if they are not registered as reflectively accessible, as well as the fact that signer classes are not correctly registered during analysis when they are. I have a fix on the way for these issues.

SergejIsbrecht · 2023-11-22T10:51:40Z

@loicottet ,

would it be possible to backport it to 23.x?

loicottet · 2023-11-24T14:34:02Z

Yes, we can do that

SergejIsbrecht added bug native-image labels Jun 14, 2023

oubidar-Abderrahim assigned loicottet Jun 20, 2023

mkralik3 mentioned this issue Jun 30, 2023

chore: Update Graalvm version in GitHub workflows kaoto-archive/kaoto-backend#731

Merged

ArloL mentioned this issue Sep 20, 2023

use new graalvm distribution ArloL/chorito#242

Closed

ArloL mentioned this issue Dec 9, 2023

update to java21 ArloL/chorito#241

Merged

ArloL mentioned this issue Mar 12, 2024

1.1.8 not updating the Windows environment variables graalvm/setup-graalvm#88

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Building an image with conscrypt included throws an VMError (Image heap writing found a class not seen during static analysis) #6793

Building an image with conscrypt included throws an VMError (Image heap writing found a class not seen during static analysis) #6793

SergejIsbrecht commented Jun 14, 2023 •

edited

Loading

koutheir commented Jun 14, 2023 •

edited

Loading

koutheir commented Jun 14, 2023

loicottet commented Jun 20, 2023

msupic commented Jul 6, 2023

SergejIsbrecht commented Nov 14, 2023 •

edited

Loading

OpenSpaghettiSauce commented Nov 19, 2023

loicottet commented Nov 21, 2023

SergejIsbrecht commented Nov 22, 2023

loicottet commented Nov 24, 2023

Building an image with conscrypt included throws an VMError (Image heap writing found a class not seen during static analysis) #6793

Building an image with conscrypt included throws an VMError (Image heap writing found a class not seen during static analysis) #6793

Comments

SergejIsbrecht commented Jun 14, 2023 • edited Loading

koutheir commented Jun 14, 2023 • edited Loading

koutheir commented Jun 14, 2023

loicottet commented Jun 20, 2023

msupic commented Jul 6, 2023

SergejIsbrecht commented Nov 14, 2023 • edited Loading

OpenSpaghettiSauce commented Nov 19, 2023

loicottet commented Nov 21, 2023

SergejIsbrecht commented Nov 22, 2023

loicottet commented Nov 24, 2023

SergejIsbrecht commented Jun 14, 2023 •

edited

Loading

koutheir commented Jun 14, 2023 •

edited

Loading

SergejIsbrecht commented Nov 14, 2023 •

edited

Loading