java.lang.SecurityException: SHA-256 digest error for org/bouncycastle/operator/OperatorCreationException.class

[LazyIonEs]

java.lang.SecurityException: SHA-256 digest error for org/bouncycastle/operator/OperatorCreationException.class

[LazyIonEs]

While I was solving the problem on my own I found this : #1675
I tried Execute packageUberJarForCurrentOS, Run with java -jar file.jar, and an error occurred. According to the operation in the article, I added

tasks.register<Zip>("repackageUberJar") {
    val packageReleaseUberJarForCurrentOS = tasks.getByName("packageReleaseUberJarForCurrentOS")
    dependsOn(packageReleaseUberJarForCurrentOS)
    val file = packageReleaseUberJarForCurrentOS.outputs.files.first()
    val output = File(file.parentFile, "${file.nameWithoutExtension}-repacked.jar")
    archiveFileName.set(output.absolutePath)
    destinationDirectory.set(file.parentFile.absoluteFile)
    exclude("META-INF/*.SF")
    exclude("META-INF/*.RSA")
    exclude("META-INF/*.DSA")
    from(project.zipTree(file))
    doLast {
        delete(file)
        output.renameTo(file)
        logger.lifecycle("The repackaged jar is written to ${archiveFile.get().asFile.canonicalPath}")
    }
}

I Execute packageUberJarForCurrentOS again, and Run with java -jar file.jar, all functions run normally, but when I want to Execute packageReleaseDistributionForCurrentOS, I found that there will still be SecurityException, so How to exclude few META-INF files for packageReleaseDistributionForCurrentOS, I think this may work for me very useful

[LazyIonEs]

I tried again to solve this problem myself

1. Try to execute runReleaseDistributable and an error occurs.
   
2. Looking at the log, I found that this jar package was copied from .gradle and filtered. I don’t know what was done in the middle.
   
3. Find the original jar file, execute jarsigner -verify, and it will prompt that the jar has been verified.
4. Find the copied jar file and execute jarsigner -verify again, prompt

jarsigner: java.lang.SecurityException: SHA-256 digest error for org/bouncycastle/LICENSE.class

5. Delete the internal META-INF/*.RSA, META-INF/*.SF, META-INF/*.DSA, META-INF/*.EC files from the copied bcpkix, bcprov, and bcutil jars.
6. Execute zip -d file.jar 'META-INF/*.SF' 'META-INF/*.RSA' 'META-INF/*.DSA' 'META-INF/*.EC'
7. Double-click to launch file.app
8. The program runs normally, no errors are reported

I want to know what was filtered in step 2, and how can I delete some files under META-INF when copying?

[LazyIonEs]

I'm very sorry. During my subsequent debugging, I found that this has nothing to do with resources. I will provide a minimal reproduction program to help troubleshoot the problem.

https://github.com/LazyIonEs/compose-multiplatform-desktop-template

In the above program, when I add in compose-desktop.pro

-keepclasseswithmembers public class MainKt {
     public static void main(java.lang.String[]);
}

-keep class org.bouncycastle.** { *; }

When executing runReleaseDistributable, an error message java.lang.SecurityException: SHA-256 digest error for org/bouncycastle/operator/OperatorCreationException.class will appear.

I think it may be because of the rule -keep class org.bouncycastle.** { *; }, but when I delete it, the rule in compose-desktop.pro is

-keepclasseswithmembers public class MainKt {
     public static void main(java.lang.String[]);
}

# -keep class org.bouncycastle.** { *; }

I executed runReleaseDistributable again, and an error message cannot create signer: no such algorithm: SHA256WITHRSA for provider BC appeared.

I don't understand why

Can you help me solve this problem?