[Geoserver-devel] Build keeps on failing on Travis-CI for Oracle JDK, on unsigned jar entries

[Andrea_Aime4]

Hi,
the Travis build keeps on failing in the security UI LDAP module with this error:

Tests run: 5, Failures: 0, Errors: 1, Skipped: 4, Time elapsed: 43.477 sec <<< FAILURE!
testTestConnectionWitUserGroupService(org.geoserver.web.security.ldap.LDAPAuthProviderPanelTest)  Time elapsed: 39229 sec  <<< ERROR!
org.jasypt.exceptions.EncryptionInitializationException: java.lang.SecurityException: JCE cannot authenticate the provider BC
	at org.jasypt.encryption.pbe.StandardPBEByteEncryptor.initialize(StandardPBEByteEncryptor.java:708)
	at org.jasypt.encryption.pbe.StandardPBEByteEncryptor.encrypt(StandardPBEByteEncryptor.java:830)
	at org.geoserver.web.GeoserverWicketEncrypterFactory$CryptImpl.crypt(GeoserverWicketEncrypterFactory.java:74)
	at org.apache.wicket.util.crypt.AbstractCrypt.encryptStringToByteArray(AbstractCrypt.java:163)
	at org.apache.wicket.util.crypt.AbstractCrypt.encryptUrlSafe(AbstractCrypt.java:86)
	at org.apache.wicket.protocol.http.request.CryptedUrlWebRequestCodingStrategy.encodeURL(CryptedUrlWebRequestCodingStrategy.java:229)
	at org.apache.wicket.protocol.http.request.CryptedUrlWebRequestCodingStrategy.encode(CryptedUrlWebRequestCodingStrategy.java:140)
	at org.geoserver.web.GeoServerRequestEncodingStrategy.encode(GeoServerRequestEncodingStrategy.java:103)
	at org.apache.wicket.RequestCycle.encodeUrlFor(RequestCycle.java:811)
	at org.apache.wicket.RequestCycle.urlFor(RequestCycle.java:1011)
	at org.apache.wicket.protocol.http.MockWebApplication.processRequestCycle(MockWebApplication.java:491)
	at org.apache.wicket.protocol.http.MockWebApplication.processRequestCycle(MockWebApplication.java:413)
	at org.apache.wicket.util.tester.BaseWicketTester.startPage(BaseWicketTester.java:302)
	at org.apache.wicket.util.tester.BaseWicketTester.startPage(BaseWicketTester.java:243)
	at org.apache.wicket.util.tester.BaseWicketTester.startPage(BaseWicketTester.java:288)
	at org.geoserver.web.security.ldap.LDAPAuthProviderPanelTest.setupPanel(LDAPAuthProviderPanelTest.java:87)
	at org.geoserver.web.security.ldap.LDAPAuthProviderPanelTest.setupPanel(LDAPAuthProviderPanelTest.java:73)
	at org.geoserver.web.security.ldap.LDAPAuthProviderPanelTest.testTestConnectionWitUserGroupService(LDAPAuthProviderPanelTest.java:117)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:483)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:47)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:44)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
	at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27)
	at org.junit.rules.RunRules.evaluate(RunRules.java:20)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:271)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:70)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:50)
	at org.junit.runners.ParentRunner$3.run(ParentRunner.java:238)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:63)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:236)
	at org.junit.runners.ParentRunner.access$000(ParentRunner.java:53)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:229)
	at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
	at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:309)
	at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:252)
	at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:141)
	at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:112)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:483)
	at org.apache.maven.surefire.util.ReflectionUtils.invokeMethodWithArray(ReflectionUtils.java:189)
	at org.apache.maven.surefire.booter.ProviderFactory$ProviderProxy.invoke(ProviderFactory.java:165)
	at org.apache.maven.surefire.booter.ProviderFactory.invokeProvider(ProviderFactory.java:85)
	at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBoo-ter.java:115)
	at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:75)
Caused by: java.lang.SecurityException: JCE cannot authenticate the provider BC
	at javax.crypto.JceSecurity.getInstance(JceSecurity.java:114)
	at javax.crypto.SecretKeyFactory.getInstance(SecretKeyFactory.java:244)
	at org.jasypt.encryption.pbe.StandardPBEByteEncryptor.initialize(StandardPBEByteEncryptor.java:667)
	... 51 more
Caused by: java.util.jar.JarException: file:/home/travis/.m2/repository/org/apache/directory/server/apacheds-all/1.5.5/apacheds-all-1.5.5.jar has unsigned entries - org/apache/directory/server/configuration/ApacheDS$1.class
	at javax.crypto.JarVerifier.verifySingleJar(JarVerifier.java:464)
	at javax.crypto.JarVerifier.verifyJars(JarVerifier.java:322)
	at javax.crypto.JarVerifier.verify(JarVerifier.java:250)
	at javax.crypto.JceSecurity.verifyProviderJar(JceSecurity.java:160)
	at javax.crypto.JceSecurity.getVerificationResult(JceSecurity.java:186)
	at javax.crypto.JceSecurity.getInstance(JceSecurity.java:110)
	... 53 more

It’s affecting both the Oracle JDK7 and JDK8 builds, but not the openjdk one:
https://travis-ci.org/geoserver/geoserver/jobs/55093376

I cannot reproduce using Oracle JDK 7 or JDK 8 on Windows, any clue as to why that might be happening?

Cheers
Andrea

···

==

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

==

Ing. Andrea Aime

@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

AVVERTENZE AI SENSI DEL D.Lgs. 196/2003

Le informazioni contenute in questo messaggio di posta elettronica e/o nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il loro utilizzo è consentito esclusivamente al destinatario del messaggio, per le finalità indicate nel messaggio stesso. Qualora riceviate questo messaggio senza esserne il destinatario, Vi preghiamo cortesemente di darcene notizia via e-mail e di procedere alla distruzione del messaggio stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso, divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od utilizzarlo per finalità diverse, costituisce comportamento contrario ai principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for the attention and use of the named addressee(s) and may be confidential or proprietary in nature or covered by the provisions of privacy act (Legislative Decree June, 30 2003, no.196 - Italy’s New Data Protection Code).Any use not in accord with its purpose, any disclosure, reproduction, copying, distribution, or either dissemination, either whole or partial, is strictly forbidden except previous formal approval of the named addressee(s). If you are not the intended recipient, please contact immediately the sender by telephone, fax or e-mail and delete the information in this message that has been received in error. The sender does not give any warranty or accept liability as the content, accuracy or completeness of sent messages and accepts no responsibility for changes made after they were sent or for other risks which arise as a result of e-mail transmission, viruses, etc.

---

[Chris1]

Oracle won’t let you load security providers in their JDK/JRE unless the jar is signed (with a trust chain configured for the JVM session). OpenJDK doesn’t restrict this.

It looks like apacheds-all-1.5.5.jar is repackaging the bouncy castle security provider in there, and this is breaking existing signatures.

The kind of looks like an upstream apacheds issue - but caveated, that’s just based on a quick glance at the stacktrace.

···

On Fri, Mar 20, 2015 at 7:47 PM, Andrea Aime <andrea.aime@anonymised.com> wrote:

Hi,
the Travis build keeps on failing in the security UI LDAP module with this error:

Tests run: 5, Failures: 0, Errors: 1, Skipped: 4, Time elapsed: 43.477 sec <<< FAILURE!
testTestConnectionWitUserGroupService(org.geoserver.web.security.ldap.LDAPAuthProviderPanelTest)  Time elapsed: 39229 sec  <<< ERROR!
org.jasypt.exceptions.EncryptionInitializationException: java.lang.SecurityException: JCE cannot authenticate the provider BC
	at org.jasypt.encryption.pbe.StandardPBEByteEncryptor.initialize(StandardPBEByteEncryptor.java:708)
	at org.jasypt.encryption.pbe.StandardPBEByteEncryptor.encrypt(StandardPBEByteEncryptor.java:830)
	at org.geoserver.web.GeoserverWicketEncrypterFactory$CryptImpl.crypt(GeoserverWicketEncrypterFactory.java:74)
	at org.apache.wicket.util.crypt.AbstractCrypt.encryptStringToByteArray(AbstractCrypt.java:163)
	at org.apache.wicket.util.crypt.AbstractCrypt.encryptUrlSafe(AbstractCrypt.java:86)
	at org.apache.wicket.protocol.http.request.CryptedUrlWebRequestCodingStrategy.encodeURL(CryptedUrlWebRequestCodingStrategy.java:229)
	at org.apache.wicket.protocol.http.request.CryptedUrlWebRequestCodingStrategy.encode(CryptedUrlWebRequestCodingStrategy.java:140)
	at org.geoserver.web.GeoServerRequestEncodingStrategy.encode(GeoServerRequestEncodingStrategy.java:103)
	at org.apache.wicket.RequestCycle.encodeUrlFor(RequestCycle.java:811)
	at org.apache.wicket.RequestCycle.urlFor(RequestCycle.java:1011)
	at org.apache.wicket.protocol.http.MockWebApplication.processRequestCycle(MockWebApplication.java:491)
	at org.apache.wicket.protocol.http.MockWebApplication.processRequestCycle(MockWebApplication.java:413)
	at org.apache.wicket.util.tester.BaseWicketTester.startPage(BaseWicketTester.java:302)
	at org.apache.wicket.util.tester.BaseWicketTester.startPage(BaseWicketTester.java:243)
	at org.apache.wicket.util.tester.BaseWicketTester.startPage(BaseWicketTester.java:288)
	at org.geoserver.web.security.ldap.LDAPAuthProviderPanelTest.setupPanel(LDAPAuthProviderPanelTest.java:87)
	at org.geoserver.web.security.ldap.LDAPAuthProviderPanelTest.setupPanel(LDAPAuthProviderPanelTest.java:73)
	at org.geoserver.web.security.ldap.LDAPAuthProviderPanelTest.testTestConnectionWitUserGroupService(LDAPAuthProviderPanelTest.java:117)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:483)
	at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:47)
	at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
	at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:44)
	at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
	at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
	at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27)
	at org.junit.rules.RunRules.evaluate(RunRules.java:20)
	at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:271)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:70)
	at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:50)
	at org.junit.runners.ParentRunner$3.run(ParentRunner.java:238)
	at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:63)
	at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:236)
	at org.junit.runners.ParentRunner.access$000(ParentRunner.java:53)
	at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:229)
	at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
	at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27)
	at org.junit.runners.ParentRunner.run(ParentRunner.java:309)
	at org.apache.maven.surefire.junit4.JUnit4Provider.execute(JUnit4Provider.java:252)
	at org.apache.maven.surefire.junit4.JUnit4Provider.executeTestSet(JUnit4Provider.java:141)
	at org.apache.maven.surefire.junit4.JUnit4Provider.invoke(JUnit4Provider.java:112)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:483)
	at org.apache.maven.surefire.util.ReflectionUtils.invokeMethodWithArray(ReflectionUtils.java:189)
	at org.apache.maven.surefire.booter.ProviderFactory$ProviderProxy.invoke(ProviderFactory.java:165)
	at org.apache.maven.surefire.booter.ProviderFactory.invokeProvider(ProviderFactory.java:85)
	at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBoo-ter.java:115)
	at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:75)
Caused by: java.lang.SecurityException: JCE cannot authenticate the provider BC
	at javax.crypto.JceSecurity.getInstance(JceSecurity.java:114)
	at javax.crypto.SecretKeyFactory.getInstance(SecretKeyFactory.java:244)
	at org.jasypt.encryption.pbe.StandardPBEByteEncryptor.initialize(StandardPBEByteEncryptor.java:667)
	... 51 more
Caused by: java.util.jar.JarException: file:/home/travis/.m2/repository/org/apache/directory/server/apacheds-all/1.5.5/apacheds-all-1.5.5.jar has unsigned entries - org/apache/directory/server/configuration/ApacheDS$1.class
	at javax.crypto.JarVerifier.verifySingleJar(JarVerifier.java:464)
	at javax.crypto.JarVerifier.verifyJars(JarVerifier.java:322)
	at javax.crypto.JarVerifier.verify(JarVerifier.java:250)
	at javax.crypto.JceSecurity.verifyProviderJar(JceSecurity.java:160)
	at javax.crypto.JceSecurity.getVerificationResult(JceSecurity.java:186)
	at javax.crypto.JceSecurity.getInstance(JceSecurity.java:110)
	... 53 more

It’s affecting both the Oracle JDK7 and JDK8 builds, but not the openjdk one:
https://travis-ci.org/geoserver/geoserver/jobs/55093376

I cannot reproduce using Oracle JDK 7 or JDK 8 on Windows, any clue as to why that might be happening?

Cheers
Andrea

–

==

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

==

Ing. Andrea Aime

@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

AVVERTENZE AI SENSI DEL D.Lgs. 196/2003

Le informazioni contenute in questo messaggio di posta elettronica e/o nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il loro utilizzo è consentito esclusivamente al destinatario del messaggio, per le finalità indicate nel messaggio stesso. Qualora riceviate questo messaggio senza esserne il destinatario, Vi preghiamo cortesemente di darcene notizia via e-mail e di procedere alla distruzione del messaggio stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso, divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od utilizzarlo per finalità diverse, costituisce comportamento contrario ai principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for the attention and use of the named addressee(s) and may be confidential or proprietary in nature or covered by the provisions of privacy act (Legislative Decree June, 30 2003, no.196 - Italy’s New Data Protection Code).Any use not in accord with its purpose, any disclosure, reproduction, copying, distribution, or either dissemination, either whole or partial, is strictly forbidden except previous formal approval of the named addressee(s). If you are not the intended recipient, please contact immediately the sender by telephone, fax or e-mail and delete the information in this message that has been received in error. The sender does not give any warranty or accept liability as the content, accuracy or completeness of sent messages and accepts no responsibility for changes made after they were sent or for other risks which arise as a result of e-mail transmission, viruses, etc.

---

---

Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the
conversation now. http://goparallel.sourceforge.net/

---

Geoserver-devel mailing list
Geoserver-devel@anonymised.comsts.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/geoserver-devel

[Andrea_Aime4]

On Sat, Mar 21, 2015 at 12:58 AM, Chris Bennight <chris@anonymised.com> wrote:

Oracle won't let you load security providers in their JDK/JRE unless the
jar is signed (with a trust chain configured for the JVM session). OpenJDK
doesn't restrict this.

Ok, we'll look into it but... why isn't the same happening on my windows
box, with Oracle JDK 7 and Oracle JDK 8?
Is the windows JDK subject to different rules than a Linux one?

Anyways, I can confirm apacheds-all does contain a repackaging of
bouncycastle providers, from my local repo, looking
in the jar with 7z, it's there:

C:\Users\aaime\.m2\repository\org\apache\directory\server\apacheds-all\1.5.5\apacheds-all-1.5.5.jar\org\bouncycastle\

By the name it sort of seems there is also a non "all" version available,
I'll see if we can depend on smaller jars which
hopefully do not repackage bouncycastle

Cheers
Andrea

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

*AVVERTENZE AI SENSI DEL D.Lgs. 196/2003*

Le informazioni contenute in questo messaggio di posta elettronica e/o
nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il
loro utilizzo è consentito esclusivamente al destinatario del messaggio,
per le finalità indicate nel messaggio stesso. Qualora riceviate questo
messaggio senza esserne il destinatario, Vi preghiamo cortesemente di
darcene notizia via e-mail e di procedere alla distruzione del messaggio
stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso,
divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od
utilizzarlo per finalità diverse, costituisce comportamento contrario ai
principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for
the attention and use of the named addressee(s) and may be confidential or
proprietary in nature or covered by the provisions of privacy act
(Legislative Decree June, 30 2003, no.196 - Italy's New Data Protection
Code).Any use not in accord with its purpose, any disclosure, reproduction,
copying, distribution, or either dissemination, either whole or partial, is
strictly forbidden except previous formal approval of the named
addressee(s). If you are not the intended recipient, please contact
immediately the sender by telephone, fax or e-mail and delete the
information in this message that has been received in error. The sender
does not give any warranty or accept liability as the content, accuracy or
completeness of sent messages and accepts no responsibility for changes
made after they were sent or for other risks which arise as a result of
e-mail transmission, viruses, etc.

-------------------------------------------------------

[Chris1]

If the regular bouncycastle jar is included as well there will be classloader race - if the unbundled bouncycastle gets on the classloader first you will be fine; might be something different with the sort/load order on windows?

You can “install” in in the jre/lib directory (similar to how the jai native stuff installs, but under security) - but that’s probably not a good solution.

If the UI LDAP module is getting packaged then either maven-shade or maven-dependency plugin can be used to strip/extract the classes. Just add the bouncycastle jar as a non-packaged file.

Alternatively if it can be ensured that it loads on the classpath before the apacheds-all then it will “just work”.

I’d be happy to take a look at it tomorrow if it’s not already fixed

Chris

···

On Fri, Mar 20, 2015 at 8:04 PM, Andrea Aime <andrea.aime@anonymised.com> wrote:

On Sat, Mar 21, 2015 at 12:58 AM, Chris Bennight <chris@anonymised.com> wrote:

Oracle won’t let you load security providers in their JDK/JRE unless the jar is signed (with a trust chain configured for the JVM session). OpenJDK doesn’t restrict this.

Ok, we’ll look into it but… why isn’t the same happening on my windows box, with Oracle JDK 7 and Oracle JDK 8?
Is the windows JDK subject to different rules than a Linux one?

Anyways, I can confirm apacheds-all does contain a repackaging of bouncycastle providers, from my local repo, looking
in the jar with 7z, it’s there:

C:\Users\aaime.m2\repository\org\apache\directory\server\apacheds-all\1.5.5\apacheds-all-1.5.5.jar\org\bouncycastle\

By the name it sort of seems there is also a non “all” version available, I’ll see if we can depend on smaller jars which
hopefully do not repackage bouncycastle

Cheers

Andrea

–

==

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

==

Ing. Andrea Aime

@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

AVVERTENZE AI SENSI DEL D.Lgs. 196/2003

Le informazioni contenute in questo messaggio di posta elettronica e/o nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il loro utilizzo è consentito esclusivamente al destinatario del messaggio, per le finalità indicate nel messaggio stesso. Qualora riceviate questo messaggio senza esserne il destinatario, Vi preghiamo cortesemente di darcene notizia via e-mail e di procedere alla distruzione del messaggio stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso, divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od utilizzarlo per finalità diverse, costituisce comportamento contrario ai principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for the attention and use of the named addressee(s) and may be confidential or proprietary in nature or covered by the provisions of privacy act (Legislative Decree June, 30 2003, no.196 - Italy’s New Data Protection Code).Any use not in accord with its purpose, any disclosure, reproduction, copying, distribution, or either dissemination, either whole or partial, is strictly forbidden except previous formal approval of the named addressee(s). If you are not the intended recipient, please contact immediately the sender by telephone, fax or e-mail and delete the information in this message that has been received in error. The sender does not give any warranty or accept liability as the content, accuracy or completeness of sent messages and accepts no responsibility for changes made after they were sent or for other risks which arise as a result of e-mail transmission, viruses, etc.

---

[Andrea_Aime4]

On Sat, Mar 21, 2015 at 1:12 AM, Chris Bennight <chris@anonymised.com> wrote:

If the regular bouncycastle jar is included as well there will be
classloader race - if the unbundled bouncycastle gets on the classloader
first you will be fine; might be something different with the sort/load
order on windows?

You can "install" in in the jre/lib directory (similar to how the jai
native stuff installs, but under security) - but that's probably not a good
solution.

If the UI LDAP module is getting packaged then either maven-shade or
maven-dependency plugin can be used to strip/extract the classes. Just add
the bouncycastle jar as a non-packaged file.

Alternatively if it can be ensured that it loads on the classpath before
the apacheds-all then it will "just work".

I'd be happy to take a look at it tomorrow if it's not already fixed

That would be much appreciated, I'm about to hop on a plane and I'll be
travelling all day tomorrow and Sunday too.

By the looks of it, we need apacheds-all. The strange thing is that
apparently maven uses pom.xml order to
order classpath entries and gs-main, from which we inherit bouncycastle, is
declared before the spring-ldap-test
from which we get apacheds-all ... but wait, aren't test dependecies loaded
before the normal one in test runs?
If so, then maybe declaring a bouncycastle dependency before the
spring-ldap-test one will do the trick

Cheers
Andrea

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

*AVVERTENZE AI SENSI DEL D.Lgs. 196/2003*

Le informazioni contenute in questo messaggio di posta elettronica e/o
nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il
loro utilizzo è consentito esclusivamente al destinatario del messaggio,
per le finalità indicate nel messaggio stesso. Qualora riceviate questo
messaggio senza esserne il destinatario, Vi preghiamo cortesemente di
darcene notizia via e-mail e di procedere alla distruzione del messaggio
stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso,
divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od
utilizzarlo per finalità diverse, costituisce comportamento contrario ai
principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for
the attention and use of the named addressee(s) and may be confidential or
proprietary in nature or covered by the provisions of privacy act
(Legislative Decree June, 30 2003, no.196 - Italy's New Data Protection
Code).Any use not in accord with its purpose, any disclosure, reproduction,
copying, distribution, or either dissemination, either whole or partial, is
strictly forbidden except previous formal approval of the named
addressee(s). If you are not the intended recipient, please contact
immediately the sender by telephone, fax or e-mail and delete the
information in this message that has been received in error. The sender
does not give any warranty or accept liability as the content, accuracy or
completeness of sent messages and accepts no responsibility for changes
made after they were sent or for other risks which arise as a result of
e-mail transmission, viruses, etc.

-------------------------------------------------------

[Bart_van_den_Eijnde1]

On 21/03/15 13:18, Andrea Aime wrote:

By the looks of it, we need apacheds-all. The strange thing is that
apparently maven uses pom.xml order to
order classpath entries and gs-main, from which we inherit bouncycastle, is
declared before the spring-ldap-test
from which we get apacheds-all ... but wait, aren't test dependecies loaded
before the normal one in test runs?

Since Maven 2.0.9 (IIRC), dependencies are on the classpath in pom order, with all inherited dependencies afterwards. gs-main:test is a dependency of the parent pom, so spring-ldap-test and its apacheds-all dependency won the race.

The other change required for success was to change the Travis CI build from "clean test" to "clean install" to make sure changes can be resolved across modules. Otherwise, we are testing changed modules but not integration between them; this was resulting in much Travis CI breakage. According to the docs, pull requests do not result in repository cache update.

If so, then maybe declaring a bouncycastle dependency before the
spring-ldap-test one will do the trick

Done and merged:
https://github.com/geoserver/geoserver/pull/1001

Andrea, your bouncycastle security provider dependency order fix worked, but there is still an (apparently) unrelated failure for Oracle JDK 7 in wps-core ExecuteTest. Intermittent problem? Another victim of -T2?

I have made another test pull request to see if we get the same result.

Kind regards,

--
Ben Caradoc-Davies <ben@anonymised.com>
Director
Transient Software Limited <http://transient.nz>
New Zealand

[Andrea_Aime4]

On Fri, Apr 3, 2015 at 4:44 AM, Ben Caradoc-Davies <ben@anonymised.com> wrote:

If so, then maybe declaring a bouncycastle dependency before the

spring-ldap-test one will do the trick

Done and merged:
https://github.com/geoserver/geoserver/pull/1001

Thank you!

Andrea, your bouncycastle security provider dependency order fix worked,
but there is still an (apparently) unrelated failure for Oracle JDK 7 in
wps-core ExecuteTest. Intermittent problem? Another victim of -T2?

Can you please elaborate what makes you think T2 is the cause?
And which were the other victims of -T2?

I normally build with -T4 (GeoServer) or -T8 (GeoTools) and haven't
experienced random failures

Cheers
Andrea

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

*AVVERTENZE AI SENSI DEL D.Lgs. 196/2003*

Le informazioni contenute in questo messaggio di posta elettronica e/o
nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il
loro utilizzo è consentito esclusivamente al destinatario del messaggio,
per le finalità indicate nel messaggio stesso. Qualora riceviate questo
messaggio senza esserne il destinatario, Vi preghiamo cortesemente di
darcene notizia via e-mail e di procedere alla distruzione del messaggio
stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso,
divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od
utilizzarlo per finalità diverse, costituisce comportamento contrario ai
principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for
the attention and use of the named addressee(s) and may be confidential or
proprietary in nature or covered by the provisions of privacy act
(Legislative Decree June, 30 2003, no.196 - Italy's New Data Protection
Code).Any use not in accord with its purpose, any disclosure, reproduction,
copying, distribution, or either dissemination, either whole or partial, is
strictly forbidden except previous formal approval of the named
addressee(s). If you are not the intended recipient, please contact
immediately the sender by telephone, fax or e-mail and delete the
information in this message that has been received in error. The sender
does not give any warranty or accept liability as the content, accuracy or
completeness of sent messages and accepts no responsibility for changes
made after they were sent or for other risks which arise as a result of
e-mail transmission, viruses, etc.

-------------------------------------------------------

[Bart_van_den_Eijnde1]

On 03/04/15 19:24, Andrea Aime wrote:

Can you please elaborate what makes you think T2 is the cause?

No evidence. Just suspicion. I have had a local builds fail intermittently with -T2 so now avoid using it.

Kind regards,

--
Ben Caradoc-Davies <ben@anonymised.com>
Director
Transient Software Limited <http://transient.nz>
New Zealand

[Bart_van_den_Eijnde1]

On 04/04/15 10:00, Ben Caradoc-Davies wrote:

On 03/04/15 19:24, Andrea Aime wrote:

Can you please elaborate what makes you think T2 is the cause?

No evidence. Just suspicion. I have had a local builds fail
intermittently with -T2 so now avoid using it.

Test pull requests with five commits each show no difference in Travis CI reliability with and without -T2.

With -T2:
https://github.com/geoserver/geoserver/pull/1002

Without -T2:
https://github.com/geoserver/geoserver/pull/1003

Andrea, I see you have already committed fixes for the wps-core ProcessMonkey and CRS failures. Thanks!

I will make another pull request to see if Travis CI reliability improves.

Kind regards,

--
Ben Caradoc-Davies <ben@anonymised.com>
Director
Transient Software Limited <http://transient.nz>
New Zealand

[Bart_van_den_Eijnde1]

On 05/04/15 09:16, Ben Caradoc-Davies wrote:

Andrea, I see you have already committed fixes for the wps-core
ProcessMonkey and CRS failures. Thanks!
I will make another pull request to see if Travis CI reliability improves.

Andrea, here is a pull request with ten commits, drip fed to trigger Travis CI for each, to test whether your most recent fixes improve build stability:
https://github.com/geoserver/geoserver/pull/1004

Kind regards,

--
Ben Caradoc-Davies <ben@anonymised.com>
Director
Transient Software Limited <http://transient.nz>
New Zealand

[Andrea_Aime4]

On Sat, Apr 4, 2015 at 11:16 PM, Ben Caradoc-Davies <ben@anonymised.com>
wrote:

Andrea, I see you have already committed fixes for the wps-core
ProcessMonkey and CRS failures. Thanks!

I will make another pull request to see if Travis CI reliability improves.

Right... I still saw a failure in CSW, I don't have a link to it, but it
seemed a validation failure,
I'm guessing code trying to fetch schemas to perform validation and failing
to do so

Cheers
Andrea

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

*AVVERTENZE AI SENSI DEL D.Lgs. 196/2003*

Le informazioni contenute in questo messaggio di posta elettronica e/o
nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il
loro utilizzo è consentito esclusivamente al destinatario del messaggio,
per le finalità indicate nel messaggio stesso. Qualora riceviate questo
messaggio senza esserne il destinatario, Vi preghiamo cortesemente di
darcene notizia via e-mail e di procedere alla distruzione del messaggio
stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso,
divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od
utilizzarlo per finalità diverse, costituisce comportamento contrario ai
principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for
the attention and use of the named addressee(s) and may be confidential or
proprietary in nature or covered by the provisions of privacy act
(Legislative Decree June, 30 2003, no.196 - Italy's New Data Protection
Code).Any use not in accord with its purpose, any disclosure, reproduction,
copying, distribution, or either dissemination, either whole or partial, is
strictly forbidden except previous formal approval of the named
addressee(s). If you are not the intended recipient, please contact
immediately the sender by telephone, fax or e-mail and delete the
information in this message that has been received in error. The sender
does not give any warranty or accept liability as the content, accuracy or
completeness of sent messages and accepts no responsibility for changes
made after they were sent or for other risks which arise as a result of
e-mail transmission, viruses, etc.

-------------------------------------------------------

[Bart_van_den_Eijnde1]

On 05/04/15 09:53, Andrea Aime wrote:

Right... I still saw a failure in CSW, I don't have a link to it, but it
seemed a validation failure,
I'm guessing code trying to fetch schemas to perform validation and failing
to do so

This one fails in gs-main:
https://s3.amazonaws.com/archive.travis-ci.org/jobs/57193585/log.txt

All the failures in this build appear to be CRS-lookup-related. Is there a potential race condition initialising the EPSG database when two modules attempt to do so concurrently?

Kind regards,

--
Ben Caradoc-Davies <ben@anonymised.com>
Director
Transient Software Limited <http://transient.nz>
New Zealand

[Bart_van_den_Eijnde1]

On 05/04/15 11:21, Ben Caradoc-Davies wrote:

On 05/04/15 09:53, Andrea Aime wrote:

Right... I still saw a failure in CSW, I don't have a link to it, but it
seemed a validation failure,
I'm guessing code trying to fetch schemas to perform validation and failing
to do so

This one fails in gs-main:
https://s3.amazonaws.com/archive.travis-ci.org/jobs/57193585/log.txt

All the failures in this build appear to be CRS-lookup-related. Is there
a potential race condition initialising the EPSG database when two
modules attempt to do so concurrently?

Other than this single failed build, we now have 29 out of 30 Travis CI builds passing for the 10 commits in PR #1004. Pretty close to announcing that Travis CI for GeoServer is back in business!

Kind regards,

--
Ben Caradoc-Davies <ben@anonymised.com>
Director
Transient Software Limited <http://transient.nz>
New Zealand

[Andrea_Aime4]

On Sun, Apr 5, 2015 at 1:21 AM, Ben Caradoc-Davies <ben@anonymised.com> wrote:

On 05/04/15 09:53, Andrea Aime wrote:

Right... I still saw a failure in CSW, I don't have a link to it, but it
seemed a validation failure,
I'm guessing code trying to fetch schemas to perform validation and
failing
to do so

This one fails in gs-main:
https://s3.amazonaws.com/archive.travis-ci.org/jobs/57193585/log.txt

All the failures in this build appear to be CRS-lookup-related. Is there a
potential race condition initialising the EPSG database when two modules
attempt to do so concurrently?

There is potential for pretty much anything in the universe, but
the ThreadedHsqlEpsgFactory uses NIO locks
to prevent two processes to try and unpack the hsql database at the same
time, so in theory we should have issues
(well aware that practice does not always agree).

Also, we don't have any initialization error from the hsql subsystem, which
is odd too.
But yeah, from the error it kind of looks as if the EPSG database was not
even available.

Also, the failure happens in the main module, the modules built in parallel
are parent
poms and other modules that are just dependencies sets, so I don't see
anything
else that could have tried to initialize the EPSG database in parallel

Long story short, I don't have anything to work against at the moment...

Cheers
Andrea

--

GeoServer Professional Services from the experts! Visit
http://goo.gl/NWWaa2 for more information.

Ing. Andrea Aime
@geowolf
Technical Lead

GeoSolutions S.A.S.
Via Poggio alle Viti 1187
55054 Massarosa (LU)
Italy
phone: +39 0584 962313
fax: +39 0584 1660272
mob: +39 339 8844549

http://www.geo-solutions.it
http://twitter.com/geosolutions_it

*AVVERTENZE AI SENSI DEL D.Lgs. 196/2003*

Le informazioni contenute in questo messaggio di posta elettronica e/o
nel/i file/s allegato/i sono da considerarsi strettamente riservate. Il
loro utilizzo è consentito esclusivamente al destinatario del messaggio,
per le finalità indicate nel messaggio stesso. Qualora riceviate questo
messaggio senza esserne il destinatario, Vi preghiamo cortesemente di
darcene notizia via e-mail e di procedere alla distruzione del messaggio
stesso, cancellandolo dal Vostro sistema. Conservare il messaggio stesso,
divulgarlo anche in parte, distribuirlo ad altri soggetti, copiarlo, od
utilizzarlo per finalità diverse, costituisce comportamento contrario ai
principi dettati dal D.Lgs. 196/2003.

The information in this message and/or attachments, is intended solely for
the attention and use of the named addressee(s) and may be confidential or
proprietary in nature or covered by the provisions of privacy act
(Legislative Decree June, 30 2003, no.196 - Italy's New Data Protection
Code).Any use not in accord with its purpose, any disclosure, reproduction,
copying, distribution, or either dissemination, either whole or partial, is
strictly forbidden except previous formal approval of the named
addressee(s). If you are not the intended recipient, please contact
immediately the sender by telephone, fax or e-mail and delete the
information in this message that has been received in error. The sender
does not give any warranty or accept liability as the content, accuracy or
completeness of sent messages and accepts no responsibility for changes
made after they were sent or for other risks which arise as a result of
e-mail transmission, viruses, etc.

-------------------------------------------------------