Search code examples
springmavenspring-mvcjettybouncycastle

BouncyCastle causing scan timeout in SpringMVC

I was running a SpringMVC application in Jetty 9.2.10.v20150310 with no problem. However as soon as I add a dependency on BouncyCastle, the scan takes forever and the server times out.

I only have one BouncyCastle dependency in the project

     <!-- bouncy castle -->
    <dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcpkix-jdk15on</artifactId>
        <version>1.54</version>
    </dependency>

A dependency tree confirms that:

mvn dependency:tree -Dincludes=org.bouncycastle

produces:

[INFO] Building application-myapp 1.0.0-SNAPSHOT
[INFO] ------------------------------------------------------------------        ------
[INFO]
[INFO] --- maven-dependency-plugin:2.8:tree (default-cli) @ application-myapp ---
[INFO] com.my-company:application-myapp:war:1.0.0-SNAPSHOT
[INFO] \- org.bouncycastle:bcpkix-jdk15on:jar:1.54:compile
[INFO]    \- org.bouncycastle:bcprov-jdk15on:jar:1.54:compile
[INFO] ------------------------------------------------------------------    ------
[INFO] BUILD SUCCESS

Anyone see this before?

Note: I also tried with the latest Jetty version 9.3.10.v20160621 with the same result

When I run the mvn:jetty process with -X I see it is stuck in a long loop scanning the BouncyCastle jar, basically seeing output like this for about two minutes:

[DEBUG] Scanning class from jar jar:file:///C:/Users/vgrazi/.m2/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar!/org/bouncycastle/crypto/digests/SHA3Digest.class
[DEBUG] Scanning class from jar jar:file:///C:/Users/vgrazi/.m2/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar!/org/bouncycastle/crypto/digests/SHA512Digest.class
[DEBUG] Scanning class from jar jar:file:///C:/Users/vgrazi/.m2/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar!/org/bouncycastle/crypto/digests/SHA512tDigest.class
[DEBUG] Scanning class from jar jar:file:///C:/Users/vgrazi/.m2/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar!/org/bouncycastle/crypto/digests/SHAKEDigest.class
[DEBUG] Scanning class from jar jar:file:///C:/Users/vgrazi/.m2/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar!/org/bouncycastle/crypto/digests/SM3Digest.class
[DEBUG] Scanning class from jar jar:file:///C:/Users/vgrazi/.m2/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar!/org/bouncycastle/crypto/digests/ShortenedDigest.class
[DEBUG] Scanning class from jar jar:file:///C:/Users/vgrazi/.m2/org/bouncycastle/bcprov-jdk15on/1.54/bcprov-jdk15on-1.54.jar!/org/bouncycastle/crypto/digests/SkeinDigest.class
[DEBUG] Closing JarFile C:\Users\vgrazi\.m2\org\bouncycastle\bcprov-jdk15on\1.54\bcprov-jdk15on-1.54.jar
[DEBUG] Closing JarFile C:\Users\vgrazi\.m2\org\bouncycastle\bcprov-jdk15on\1.54\bcprov-jdk15on-1.54.jar
[DEBUG] Closing JarFile C:\Users\vgrazi\.m2\org\bouncycastle\bcprov-jdk15on\1.54\bcprov-jdk15on-1.54.jar
Solution

  • We got this working by eliminating bouncycastle jars from the jetty-maven-plugin. Note the "exclude" bouncycastle lookahead regex in the webInfIncludeJarPattern:

    <plugin>
  <groupId>org.eclipse.jetty</groupId>
  <artifactId>jetty-maven-plugin</artifactId>
  <version>${jetty.version}</version>
  <configuration combine.self="override">
      . . .
      <webApp>
        <contextPath>${jetty.context}</contextPath>
          <webInfIncludeJarPattern>^((?!bouncycastle).)*$</webInfIncludeJarPattern>
      </webApp>
      <jettyConfig>${jetty.xml}</jettyConfig>
       . . .