browser-mob proxy - java.lang.SecurityException when executing jar packaged by maven - maven

Question

I am using browser-mob proxy in my web application to emulate a proxy server. After performing an mvn clean package, when I execute the jar I get the following the error:
Exception in thread "main" java.lang.SecurityException: no manifiest section for signature file entry org/bouncycastle/asn1/ocsp/ResponderID.class
at sun.security.util.SignatureFileVerifier.verifySection(SignatureFileVerifier.java:399)
at sun.security.util.SignatureFileVerifier.processImpl(SignatureFileVerifier.java:250)
at sun.security.util.SignatureFileVerifier.process(SignatureFileVerifier.java:193)
at java.util.jar.JarVerifier.processEntry(JarVerifier.java:305)
at java.util.jar.JarVerifier.update(JarVerifier.java:216)
at java.util.jar.JarFile.initializeVerifier(JarFile.java:341)
at java.util.jar.JarFile.getInputStream(JarFile.java:406)
at sun.misc.URLClassPath$JarLoader$2.getInputStream(URLClassPath.java:752)
at sun.misc.Resource.cachedInputStream(Resource.java:77)
at sun.misc.Resource.getByteBuffer(Resource.java:160)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:436)
at java.net.URLClassLoader.access$100(URLClassLoader.java:71)
at java.net.URLClassLoader$1.run(URLClassLoader.java:361)
at java.net.URLClassLoader$1.run(URLClassLoader.java:355)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:354)
at java.lang.ClassLoader.loadClass(ClassLoader.java:423)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:308)
at java.lang.ClassLoader.loadClass(ClassLoader.java:356)
at sun.launcher.LauncherHelper.checkAndLoadMain(LauncherHelper.java:472)
The Meta-Inf folder does not have any signature certificates which I can exclude while building my jar.

Answer 1

I remember having a similar problem with some bouncycastle classes.
My problem was caused by a "ueber-jar" (in my case apache-ds-all) that contained not only the classes from the apache-ds project, but also all classes from the apache-ds 3rd Party dependencies.
Since the bouncycastle classes are originally shipped in a signed jar file, I got a security Exception when the classes where loaded from a different location - which is the whole point of signing a JAR in the first place.
I'd recommend to scan all the JAR files in your classpath to see if org/bouncycastle/asn1/ocsp/ResponderID.class is contained in a non-bouncycastle distribution jar file.
Hope that helps !

Answer 2

I had the security problem in the ic4u package. I just excluded it form the dependency and everything worked fine.
<dependency>
<groupId>biz.neustar</groupId>
<artifactId>browsermob-proxy</artifactId>
<version>${browser-mob-version}</version>
<exclusions>
<exclusion>
<groupId>org.seleniumhq.selenium</groupId>
<artifactId>selenium-api</artifactId>
</exclusion>
<exclusion>
<artifactId>icu4j</artifactId>
<groupId>com.ibm.icu</groupId>
</exclusion>
</exclusions>
</dependency>

Answer 3

I had exactly the same problem with iText 4.2.0 and the bouncycastle library (SecurityExceptions related to ResponderID and other classes).
I ended up deleting the META-INF directories in the signed jars shipped with iText. It might not be the most elegant way but at least it solved the problem for me.