Unable to initialize BouncyCastleAlpnSslUtils during GraalVM native-image build

[smoell]

Questions

Do not use this issue tracker to ask questions, instead use one of these channels. Questions will likely be closed without notice.

Version

4.1.0

Context

I encountered an exception which looks suspicious while I was building my application with Graal 21.1,0 using native-image:

Unable to initialize BouncyCastleAlpnSslUtils. 
java.lang.ClassNotFoundException: org.bouncycastle.jsse.BCSSLEngine
        at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:471)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:589)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:522)
        at java.base/java.lang.Class.forName0(Native Method)
        at java.base/java.lang.Class.forName(Class.java:315)
        at io.netty.handler.ssl.BouncyCastleAlpnSslUtils.<clinit>(BouncyCastleAlpnSslUtils.java:63)
        at java.base/jdk.internal.misc.Unsafe.ensureClassInitialized0(Native Method)
        at java.base/jdk.internal.misc.Unsafe.ensureClassInitialized(Unsafe.java:1042)
        at jdk.unsupported/sun.misc.Unsafe.ensureClassInitialized(Unsafe.java:698)
        at com.oracle.svm.hosted.classinitialization.ConfigurableClassInitialization.ensureClassInitialized(ConfigurableClassInitialization.java:176)
        at com.oracle.svm.hosted.classinitialization.ConfigurableClassInitialization.computeInitKindAndMaybeInitializeClass(ConfigurableClassInitialization.java:614)
        at com.oracle.svm.hosted.classinitialization.ConfigurableClassInitialization.computeInitKindAndMaybeInitializeClass(ConfigurableClassInitialization.java:129)
        at com.oracle.svm.hosted.classinitialization.ConfigurableClassInitialization.shouldInitializeAtRuntime(ConfigurableClassInitialization.java:157)
        at com.oracle.svm.hosted.SVMHost.isInitialized(SVMHost.java:296)
        at com.oracle.graal.pointsto.meta.AnalysisType.isInitialized(AnalysisType.java:789)
        at jdk.internal.vm.compiler/org.graalvm.compiler.java.BytecodeParser.maybeEagerlyInitialize(BytecodeParser.java:4454)
        at jdk.internal.vm.compiler/org.graalvm.compiler.java.BytecodeParser.genInvokeStatic(BytecodeParser.java:1658)
        at jdk.internal.vm.compiler/org.graalvm.compiler.java.BytecodeParser.genInvokeStatic(BytecodeParser.java:1651)
        at jdk.internal.vm.compiler/org.graalvm.compiler.java.BytecodeParser.processBytecode(BytecodeParser.java:5448)
        at jdk.internal.vm.compiler/org.graalvm.compiler.java.BytecodeParser.iterateBytecodesForBlock(BytecodeParser.java:3451)
        at jdk.internal.vm.compiler/org.graalvm.compiler.java.BytecodeParser.processBlock(BytecodeParser.java:3258)
        at jdk.internal.vm.compiler/org.graalvm.compiler.java.BytecodeParser.build(BytecodeParser.java:1125)
        at jdk.internal.vm.compiler/org.graalvm.compiler.java.BytecodeParser.buildRootMethod(BytecodeParser.java:1019)
        at jdk.internal.vm.compiler/org.graalvm.compiler.java.GraphBuilderPhase$Instance.run(GraphBuilderPhase.java:84)
        at com.oracle.svm.hosted.phases.SharedGraphBuilderPhase.run(SharedGraphBuilderPhase.java:76)
        at jdk.internal.vm.compiler/org.graalvm.compiler.phases.Phase.run(Phase.java:49)
        at jdk.internal.vm.compiler/org.graalvm.compiler.phases.BasePhase.apply(BasePhase.java:212)
        at jdk.internal.vm.compiler/org.graalvm.compiler.phases.Phase.apply(Phase.java:42)
        at jdk.internal.vm.compiler/org.graalvm.compiler.phases.Phase.apply(Phase.java:38)
        at com.oracle.graal.pointsto.flow.AnalysisParsedGraph.parseBytecode(AnalysisParsedGraph.java:113)
        at com.oracle.svm.hosted.SVMHost.parseBytecode(SVMHost.java:647)
        at com.oracle.graal.pointsto.meta.AnalysisMethod.ensureGraphParsed(AnalysisMethod.java:592)
        at com.oracle.graal.pointsto.flow.MethodTypeFlowBuilder.parse(MethodTypeFlowBuilder.java:163)
        at com.oracle.graal.pointsto.flow.MethodTypeFlowBuilder.apply(MethodTypeFlowBuilder.java:304)
        at com.oracle.graal.pointsto.flow.MethodTypeFlow.createTypeFlow(MethodTypeFlow.java:313)
        at com.oracle.graal.pointsto.flow.MethodTypeFlow.ensureTypeFlowCreated(MethodTypeFlow.java:302)
        at com.oracle.graal.pointsto.flow.MethodTypeFlow.addContext(MethodTypeFlow.java:103)
        at com.oracle.graal.pointsto.DefaultAnalysisPolicy$DefaultVirtualInvokeTypeFlow.onObservedUpdate(DefaultAnalysisPolicy.java:227)
        at com.oracle.graal.pointsto.flow.TypeFlow.notifyObservers(TypeFlow.java:470)
        at com.oracle.graal.pointsto.flow.TypeFlow.update(TypeFlow.java:542)
        at com.oracle.graal.pointsto.BigBang$2.run(BigBang.java:547)
        at com.oracle.graal.pointsto.util.CompletionExecutor.lambda$execute$0(CompletionExecutor.java:173)
        at java.base/java.util.concurrent.ForkJoinTask$RunnableExecuteAction.exec(ForkJoinTask.java:1426)
        at java.base/java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:290)
        at java.base/java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1020)
        at java.base/java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1656)
        at java.base/java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1594)
        at java.base/java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:183)

Do you have a reproducer?

• https://github.com/aws-samples/reactive-refarch-cloudformation/
• https://gist.github.com/smoell/70a0f5af8221d8a0749b8fc100aec48a

Steps to reproduce

1. Clone repository using git clone https://github.com/aws-samples/reactive-refarch-cloudformation/
2. cd reactive-refarch-cloudformation/services/tracking-service/reactive-vertx
3. Replace pom.xml in directory with https://gist.github.com/smoell/70a0f5af8221d8a0749b8fc100aec48a
4. docker image build -f ./Dockerfile-native -t smoell/reactive-vertx-native:2.0 .

Extra

• Vert.x version 4.1.0
• GraalVM version 21.1.0

[vietj]

did you have this issue before ?

[vietj]

it might be related to Netty upgrade I think

[smoell]

No, this is the first time I ran into this issue.

[pmlopes]

@vietj @smoell this is a netty upgrade related issue. Vert.x doesn't use any crypto libraries except the ones provided by the JDK, the initialization happens upstream in netty here:

https://github.com/netty/netty/blob/a98c60283b38830607780e039c7dd52715ec5814/handler/src/main/java/io/netty/handler/ssl/BouncyCastleAlpnSslUtils.java

This is a new feature added in April 2021 in netty which hasn't been tested with native images. The fix IMHO should be like the rest, in netty, add the class to the "initialize at runtime" list and all the dependant classes that may also need to be fixed...

[pmlopes]

I've added a comment upstream linking to this issue. I'm probably not the best one to address this one as I don't know the internals of BC and allowing/denying classes may have impact in the overall security of an application.

[perezd]

I'm seeing this as well, graal native image 21.2.0 and Vertx 4.1.3, this is definitely a netty problem fwiw.

[vietj]

has this been reported to Netty?

On Wed, Sep 1, 2021 at 2:12 AM Derek Perez @.***> wrote:

I'm seeing this as well, graal native image 21.2.0 and Vertx 4.1.3, this is definitely a netty problem fwiw.

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[perezd]

Yes, here: https://github.com/netty/netty/issues/11638

[vladgon]

The issue could be related to the custom binary, try to build main, I have similar issue in Gradle build where main binary is building fine, but custom is failing, the exclude config is not passed in custom binary case. https://github.com/graalvm/native-build-tools/issues/478