You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "avineshsachan (via GitHub)" <gi...@apache.org> on 2026/06/24 12:44:19 UTC
[I] Issue: jarsigner Unable to Sign Apache Iceberg JARs [iceberg]
avineshsachan opened a new issue, #16949:
URL: https://github.com/apache/iceberg/issues/16949
### Apache Iceberg version
1.11.0 (latest release)
### Query engine
Flink
### Please describe the bug 🐞
The Java jarsigner tool is failing to sign the following Apache Iceberg JAR files:
iceberg-aws-bundle 1.11.0 :https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-aws-bundle/1.11.0
iceberg-flink-runtime-2.1 1.11.0 : https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-flink-runtime-2.1/1.11.0
Error encountered during signing:
java.util.zip.ZipException: duplicate entry: LICENSE
Description:
When attempting to sign the above JARs using jarsigner, the process fails with a ZipException indicating a duplicate entry for LICENSE within the JAR archive. This is likely caused by the JAR being an uber/fat JAR (a bundled JAR that merges multiple dependencies), which may contain duplicate LICENSE files from different bundled libraries, making it non-compliant with the ZIP specification and incompatible with the jarsigner tool.
### Willingness to contribute
- [ ] I can contribute a fix for this bug independently
- [ ] I would be willing to contribute a fix for this bug with guidance from the Iceberg community
- [x] I cannot contribute a fix for this bug at this time
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Issue: jarsigner Unable to Sign Apache Iceberg JARs [iceberg]
Posted by "RussellSpitzer (via GitHub)" <gi...@apache.org>.
RussellSpitzer commented on issue #16949:
URL: https://github.com/apache/iceberg/issues/16949#issuecomment-4790148544
Is this a problem for us? We sign our releases with GPG?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org
Re: [I] Issue: jarsigner Unable to Sign Apache Iceberg JARs [iceberg]
Posted by "avineshsachan (via GitHub)" <gi...@apache.org>.
avineshsachan commented on issue #16949:
URL: https://github.com/apache/iceberg/issues/16949#issuecomment-4796044215
It does not seem related to GPG signing, below issue comes while signing these jars with standard java jarsigner tool utility:
java.util.zip.ZipException: duplicate entry: LICENSE & Notice file in both ot these jars
**Steeps to reproduce issue:**
1. download these jars
https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-aws-bundle/1.11.0
https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-flink-runtime-2.1/1.11.0
2. try to sign jar using java jarsigner utility
2.1 generate keystore
keytool -genkeypair -alias mykey -keyalg RSA -keysize 2048 -validity 365 -keystore my-keystore.jks -storepass changeit -keypass changeit -dname "CN=Test User, OU=Dev, O=MyOrg, L=City, ST=State, C=US"
2.2 sign using keystore, then error shall be shown
jarsigner -keystore my-keystore.jks -storepass changeit -keypass changeit iceberg-flink-runtime-2.1-1.11.0.jar mykey
jarsigner: unable to sign jar: java.util.zip.ZipException: duplicate entry: LICENSE
**root cause is duplicate LICENSE and NOTICE files inside these jars** :
jar -tf iceberg-flink-runtime-2.0-1.10.1.jar| grep -i License
LICENSE
META-INF/LICENSE
META-INF/licenses/
META-INF/licenses/org.projectnessie.nessie/
META-INF/licenses/org.projectnessie.nessie/nessie-client-0.104.5/
META-INF/licenses/org.projectnessie.nessie/nessie-client-0.104.5/LICENSE
META-INF/licenses/org.projectnessie.nessie/nessie-client-0.104.5/NOTICE
META-INF/licenses/org.projectnessie.nessie/nessie-model-0.104.5/
META-INF/licenses/org.projectnessie.nessie/nessie-model-0.104.5/LICENSE
META-INF/licenses/org.projectnessie.nessie/nessie-model-0.104.5/NOTICE
META-INF/FastDoubleParser-LICENSE
META-INF/thirdparty-LICENSE
META-INF/LICENSE.txt
org/eclipse/microprofile/openapi/annotations/info/License.class
org/eclipse/microprofile/openapi/models/info/License.class
LICENSE
jar -tf iceberg-flink-runtime-2.0-1.10.1.jar| grep -i Notice
NOTICE
META-INF/NOTICE
META-INF/licenses/org.projectnessie.nessie/nessie-client-0.104.5/NOTICE
META-INF/licenses/org.projectnessie.nessie/nessie-model-0.104.5/NOTICE
META-INF/FastDoubleParser-NOTICE
NOTICE
**Expectation :** duplicate LICENSE and NOTICE files should not be present in below jars so that stadard Java jarsigner utility can sign these jars :
https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-aws-bundle/1.11.0
https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-flink-runtime-2.1/1.11.0
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org