You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ant.apache.org by Jaikiran Pai <ja...@apache.org> on 2026/07/26 14:18:06 UTC
Building Ant with JDK 8 - ComponentBomTask fails during BOM creation
I was trying to investigate some issue with Ant on JDK 8. Against the
latest master branch I ran "./bootstrap.sh" with JAVA_HOME pointing to
JDK 8. That runs into the exception I have pasted below. I haven't yet
looked up the SBOM expectations. Is SHA3-256 mandatory for the SBOMs or
should we be using a different one when SHA3-256 isn't available?
build.xml:2312: java.lang.IllegalArgumentException:
java.security.NoSuchAlgorithmException: SHA3-256 MessageDigest not available
at
org.apache.commons.codec.digest.DigestUtils.getDigest(DigestUtils.java:156)
at
org.apache.commons.codec.digest.DigestUtils.getSha3_256Digest(DigestUtils.java:261)
at org.cyclonedx.util.BomUtils.getDigestForAlgorithm(BomUtils.java:147)
at org.cyclonedx.util.BomUtils.calculateHashes(BomUtils.java:98)
at org.cyclonedx.util.BomUtils.calculateHashes(BomUtils.java:71)
at org.apache.ant.cyclonedx.Component.addHashes(Component.java:827)
at
org.apache.ant.cyclonedx.Component.toCycloneDxComponent(Component.java:666)
at
org.apache.ant.cyclonedx.Component.toMainCycloneDxComponent(Component.java:559)
at
org.apache.ant.cyclonedx.ToolData.cacheToolInformation(ToolData.java:93)
at
org.apache.ant.cyclonedx.ToolData.getToolInformation(ToolData.java:32)
at
org.apache.ant.cyclonedx.ComponentBomTask.createMetadata(ComponentBomTask.java:300)
at
org.apache.ant.cyclonedx.ComponentBomTask.createBom(ComponentBomTask.java:236)
at
org.apache.ant.cyclonedx.ComponentBomTask.execute(ComponentBomTask.java:223)
...
Caused by: java.security.NoSuchAlgorithmException: SHA3-256
MessageDigest not available
at sun.security.jca.GetInstance.getInstance(GetInstance.java:159)
at java.security.Security.getImpl(Security.java:672)
at java.security.MessageDigest.getInstance(MessageDigest.java:176)
at
org.apache.commons.codec.digest.DigestUtils.getMessageDigest(DigestUtils.java:214)
at
org.apache.commons.codec.digest.DigestUtils.getDigest(DigestUtils.java:154)
... 56 more
-Jaikiran
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: Building Ant with JDK 8 - ComponentBomTask fails during BOM creation
Posted by Jaikiran Pai <ja...@apache.org>.
On 26/07/26 8:55 pm, Stefan Bodewig wrote:
> On 2026-07-26, Stefan Bodewig wrote:
>
>> On 2026-07-26, Jaikiran Pai wrote:
>>> I was trying to investigate some issue with Ant on JDK 8. Against the
>>> latest master branch I ran "./bootstrap.sh" with JAVA_HOME pointing to
>>> JDK 8. That runs into the exception I have pasted below. I haven't yet
>>> looked up the SBOM expectations. Is SHA3-256 mandatory for the SBOMs
>>> or should we be using a different one when SHA3-256 isn't available?
>> This the the CycloneDX Core Java library not checking whether the
>> required algorithms are there. I've opened
>> https://github.com/CycloneDX/cyclonedx-core-java/issues/848 a while ago.
>> If this causes a problem we could make SBOM generation make dependent on
>> Java 9+.
> I will just do that.
Thank you Stefan, I hadn't noticed the issue you filed with cyclonedx.
Requiring Java 9+ for SBOM generation sounds good to me. I just updated
my master branch which brings in your change and ran "./bootstrap.sh"
with Java 8 as well as Java 11. It builds fine on both versions and on
Java 11 I do see the SBOM generation happening.
-Jaikiran
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: Building Ant with JDK 8 - ComponentBomTask fails during BOM creation
Posted by Stefan Bodewig <bo...@apache.org>.
On 2026-07-26, Stefan Bodewig wrote:
> On 2026-07-26, Jaikiran Pai wrote:
>> I was trying to investigate some issue with Ant on JDK 8. Against the
>> latest master branch I ran "./bootstrap.sh" with JAVA_HOME pointing to
>> JDK 8. That runs into the exception I have pasted below. I haven't yet
>> looked up the SBOM expectations. Is SHA3-256 mandatory for the SBOMs
>> or should we be using a different one when SHA3-256 isn't available?
> This the the CycloneDX Core Java library not checking whether the
> required algorithms are there. I've opened
> https://github.com/CycloneDX/cyclonedx-core-java/issues/848 a while ago.
> If this causes a problem we could make SBOM generation make dependent on
> Java 9+.
I will just do that.
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org
Re: Building Ant with JDK 8 - ComponentBomTask fails during BOM creation
Posted by Stefan Bodewig <bo...@apache.org>.
On 2026-07-26, Jaikiran Pai wrote:
> I was trying to investigate some issue with Ant on JDK 8. Against the
> latest master branch I ran "./bootstrap.sh" with JAVA_HOME pointing to
> JDK 8. That runs into the exception I have pasted below. I haven't yet
> looked up the SBOM expectations. Is SHA3-256 mandatory for the SBOMs
> or should we be using a different one when SHA3-256 isn't available?
This the the CycloneDX Core Java library not checking whether the
required algorithms are there. I've opened
https://github.com/CycloneDX/cyclonedx-core-java/issues/848 a while ago.
If this causes a problem we could make SBOM generation make dependent on
Java 9+.
Stefan
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ant.apache.org
For additional commands, e-mail: dev-help@ant.apache.org