java.io.FileNotFoundException: JAR entry com/jcraft/jsch/jce/SignatureEdDSA.class not found after upgrading to Java 17 and Open Liberty 24.0.0.12

[Ssoli]

After upgrading our application from Java 11 to Java 17 and from JavaEE 8 to Jakarta 10, and running on Open Liberty 24.0.0.12, we are encountering the following error during startup:

java.io.FileNotFoundException: JAR entry com/jcraft/jsch/jce/SignatureEdDSA.class not found in /path/to/liberty/server/lib/jsch-0.2.21.jar

This error occurs specifically during the startup of the Open Liberty server when trying to initialize a class from the JSch library.

Environment:

• Java Version: 17
• Open Liberty Version: 24.0.0.12
• Liberty Maven Plugin Version: 3.11.0
• JSch Version: 0.2.21 (we are using this version as it is bundled with our Liberty runtime, but we are also trying a custom version of JSch, I tested 0.2.22 as well but encountered same problem)

Problem:
The specific error indicates that the class com.jcraft.jsch.jce.SignatureEdDSA is missing from the JAR file jsch-0.2.21.jar, even though the class should be part of the JSch library according to the documentation.

[2025-01-10T10:20:43.573+0100] 0000002d com.ibm.ws.logging.internal.impl.IncidentImpl I FFDC1015I: An FFDC Incident has been created: "java.io.FileNotFoundException: JAR entry com/jcraft/jsch/jce/SignatureEdDSA.class not found in /path/to/liberty/server/lib/jsch-0.2.21.jar

Despite using the correct JSch version (0.2.21), the server cannot find the required SignatureEdDSA.class file in the JAR, which seems to indicate an issue with the JAR itself or its compatibility with the newer Java versions.

Steps to Reproduce:

1. Upgrade from Java 11 to Java 17.
2. Upgrade from JavaEE 8 to Jakarta 10.
3. Use Open Liberty version 24.0.0.12.
4. Deploy the application with the bundled JSch library (0.2.21).
5. Start the Liberty server.

Expected Behavior:
The server should start without issues, loading the SignatureEdDSA class and other related classes from the JSch JAR.

Actual Behavior:
The server throws a FileNotFoundException, indicating that the SignatureEdDSA.class file is missing from the JAR.

Additional Context:
We have tried including a newer version of JSch (e.g., mwiede/jsch), but the issue persists.
We are using the Liberty Maven Plugin to deploy the application, with dependencies copied as part of the configuration.

Questions:

• Is the SignatureEdDSA class expected to be part of JSch version 0.2.21 or 0.2.22?
• Is there a known compatibility issue between JSch 0.2.21 and Java 17 or Open Liberty 24.0.0.12?
• Are there any additional steps or configurations required to ensure the SignatureEdDSA class is loaded correctly?

Potential Solutions or Workarounds:

• Could this issue be related to JSch not fully supporting Java 17 or the newer Open Liberty runtime?
• Should we try using a specific fork of JSch or a different version?

Thanks in advance for helping us.

[norrisjeremy]

Hi @Ssoli,

I can assure you that JSch supports Java 17+, as:

1. It is currently built using Java 21.
2. All unit tests & integrations tests are run with Java versions 8, 11, 17, 21 & 23.

I am unfamiliar with Open Liberty, but it sounds like there is some problem with it that is preventing it from working correctly with JSch.
Therefore I would recommend contacting them in order to determine why they are seemingly unable to load our jar file.

Thanks,
Jeremy

[norrisjeremy]

Hi @Ssoli,

By the way, while I am completely unfamiliar with Open Liberty, my first inclination is that they have may have some sort of bug with respect to handling multi-release jar-files.

The class that they report as being missing (com/jcraft/jsch/jce/SignatureEdDSA.class), is a package-private class that only exists under the Java 15 versioned directory in our jar-file:

$ jar -tvf jsch-0.2.21.jar | grep 'com/jcraft/jsch/jce/SignatureEdDSA.class'
  3645 Wed Oct 30 09:30:22 CDT 2024 META-INF/versions/15/com/jcraft/jsch/jce/SignatureEdDSA.class

According to the official multi-release jar file specification, only public or protected classes from a versioned directory are required to also be present in the top-level (un-versioned) directory:

The public API exported by the classes in a multi-release JAR file must be exactly the same across versions, hence at a minimum why versioned public or protected classes for class files under a versioned directory must preside over classes for class files under the top-level directory.

Since the SignatureEdDSA class is clearly package-private, if this is indeed the reason that Open Liberty is failing to load our jar-file, then that would seem to be a bug in Open Liberty.

Thanks,
Jeremy

[Ssoli]

Thanks for a quick response.