Bug#1032093: jameica: missing dependencies

[Thomas Uhle]

Hello Jochen,

thank you for the immediate response.  Please find my answers below.


On Tue, 28 Feb 2023, Jochen Sprickerhof wrote:

> * Thomas Uhle <thomas.uhle at mailbox.tu-dresden.de> [2023-02-27 20:58]:
> > Jameica dies with the following messages if it is started for the very 
> > first time, i.e., with an empty user profile directory $HOME/.jameica:
> > 
> > [Mon Feb 27 18:48:06 CET 2023][INFO][main][de.willuhn.jameica.gui.SplashScreen$3.run]  generating new keys and certificates ...
> > [Mon Feb 27 18:48:06 CET 2023][INFO][main][de.willuhn.jameica.security.SSLFactory.init]   generating rsa keypair
> > [Mon Feb 27 18:48:09 CET 2023][INFO][main][de.willuhn.jameica.security.SSLFactory.init]   generating selfsigned x.509 certificate
> > [Mon Feb 27 18:48:09 CET 2023][INFO][main][de.willuhn.jameica.security.SSLFactory.init]   using hostname: localhost
> > Exception in thread "main" java.lang.NoClassDefFoundError: org/bouncycastle/asn1/cms/CMSObjectIdentifiers
> > 	at org.bouncycastle.operator.DefaultSignatureNameFinder.<clinit>(Unknown Source)
> > 	at org.bouncycastle.operator.jcajce.OperatorHelper.<clinit>(Unknown Source)
> > 	at org.bouncycastle.operator.jcajce.JcaContentSignerBuilder.<init>(Unknown Source)
> > 	at de.willuhn.jameica.security.SSLFactory.init(SSLFactory.java:291)
> > 	at de.willuhn.jameica.services.SSLService.init(SSLService.java:45)
> > 	at de.willuhn.boot.BootLoader.resolve(BootLoader.java:139)
> > 	at de.willuhn.boot.BootLoader.resolve(BootLoader.java:119)
> > 	at de.willuhn.boot.BootLoader.resolve(BootLoader.java:119)
> > 	at de.willuhn.boot.BootLoader.getBootable(BootLoader.java:72)
> > 	at de.willuhn.jameica.system.Application.init(Application.java:103)
> > 	at de.willuhn.jameica.system.Application.newInstance(Application.java:87)
> > 	at de.willuhn.jameica.Main.main(Main.java:78)
> > Caused by: java.lang.ClassNotFoundException: org.bouncycastle.asn1.cms.CMSObjectIdentifiers
> > 	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:641)
> > 	at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:188)
> > 	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:520)
> > 	... 12 more
>
> I was not able to reproduce this. On an up to date Debian unstable I tried:
>
> $ sudo apt install debvm
> # create a Debian unstable VM
> $ debvm-create --size=10G -- --include=task-gnome-desktop 
> --aptopt='Apt::Install-Recommends "true"' --include=linux-image-amd64 
> --hook-dir=/usr/share/mmdebstrap/hooks/useradd
> # run it with qemu
> $ debvm-run -g -- -m 4G
> # inside the VM install hibiscus
> $ sudo apt install --no-install-recommends hibiscus
> # run it
> $ jameica
>
> Can you try this and maybe check the difference to your system?

I cannot do this, I am on an ARMv9 platform (Debian's arm64 architecture).

However, I still had bcpkix.jar linking to bcpkix-jdk18on-1.72.jar as well 
as bcprov.jar and bcputil.jar linking to bcprov-jdk18on-1.72.jar and 
bcutil-jdk18on-1.72.jar resp. which I had been downloading from Maven 
Central before I prepared the pull request for Olaf Willuhn (upstream). 
Although I thought they were basically the same, there have to be 
differences.  After reverting the links to the jar files that are provided 
by Debian, there is no such issue indeed.  So I tried to track this down 
to bcpkix.jar.  If only this jar file is exchanged by the one from Maven 
Central, then it doesn't matter whether the other two are from Debian or 
Maven Central.  Then this issue is happening.  So the difference must be 
within bcpkix.jar.  I had a look into both versions and saw that the 
manifest in Debian's bcpkix.jar specifies

   Class-Path: bcprov.jar bcutil.jar

whereas the manifest in Maven's bcpkix.jar has no class path specified. 
I guess this is the reason why it works with Debian's BouncyCastle jar 
files even if the manifest of jameica.jar does not specify a class path 
with bcutil.jar.


> I've added this to follow upstream but even when I remove the bcutil-1.72.jar 
> it works fine, so not sure what is going on.

I cannot confirm this.  After removing both bcutil-1.72.jar and 
bcutil.jar, (even with the other two libraries taken from Debian) I run 
into this issue when Jameica tries to generate the self-signed 
certificate for a new user profile.  It does not quit after the exception 
but seems to hang forever, the splash screen stays open saying "generating 
new keys and certificates ..." for minutes.  Eventually I have yet lost my 
patience and killed the process.


> Anyway, I've added both jars and uploaded a new version.
>
> Cheers Jochen

Thank you!

Cheers,

Thomas