我正在使用 jpackage 在 Mac 和 PC 上分发 Java 应用程序，当它尝试使用来自某些站点的 https 加载图像时，我遇到了握手失败。如果我在 Mac 和 PC 上从 Eclipse 或命令行运行代码，则代码可以正常工作，但如果将其作为打包应用程序运行，则不能。如果我从某些站点加载图像，问题就会消失：例如https://st4.depositphotos.com 。这让我觉得“问题站点”不在信任链中。
但是，作为打包应用程序运行时，为什么信任链会有所不同呢？
使用 java 14.0.2 和 15 可以看到相同的行为。以下示例使用 OpenJDK 运行时环境（内部版本 15+36-1562）。
请注意，jpackage 将运行时集成到应用程序中。这是一个非模块化应用程序（我展示了下面使用的 jpackage 选项）。
在 Mac 上调试并使用 -Djavax.net.debug=all 选项，我查找了打包应用程序正在使用的 trustStore。打印的路径无效，因为它以 /Applications 而不是 /Volumes 开头，但除此之外一切正常。也许这只是一个打印问题？无论哪种方式，我都使用 -Djavax.net.ssl.trustStore=/Library/Java/JavaVirtualMachines/jdk-15.jdk/Contents/Home/lib/security/cacerts 来强制打包的应用程序使用与 JDK 相同的 trustStore 和这并没有改善问题。
你认为我的代码有问题还是 jpackage 有问题？非常感谢您的帮助！
这是打包命令：
--verbose \
--type pkg \
--input HelloTest \
--name HelloTest \
--main-class HelloTest.HelloTest \
--main-jar HelloTest.jar \
--runtime-image target/java-runtime \
--java-options -Djavax.net.ssl.trustStore=/Library/Java/JavaVirtualMachines/jdk-15.jdk/Contents/Home/lib/security/cacerts \
--java-options -Djavax.net.debug=all \
--vendor "ACME Inc." \
--copyright "Copyright © 2019-20 ACME Inc." \
--mac-package-identifier com.acme.app \
--mac-package-name ACME
这是代码：
public class HelloTest{
public static void main(String... args) throws IOException {
System.out.println("javax.net.ssl.trustStore = " + System.getProperty("javax.net.ssl.trustStore"));
JFrame f = new JFrame(); //creates jframe f
Dimension screenSize = Toolkit.getDefaultToolkit().getScreenSize(); //this is your screen size
int halfWidth = screenSize.width/2;
int halfHeight = screenSize.height/2;
ImageIcon img = new ImageIcon();
//OK: ... https://st4.depositphotos.com seems to be well trusted
// String urlName = "https://st4.depositphotos.com/36188500/38581/i/1600/depositphotos_385811360-stock-photo-woman-lingerie-dog-rose.jpg";
//KO: ... https://en.iconda.solutions is only trusted when code is run from Eclipse or the command line
String urlName = "https://en.iconda.solutions/wp-content/uploads/2020/07/getting_equipped.png";
JLabel lbl = new JLabel();
URL url;
try {
url = new URL(urlName);
HttpsURLConnection httpsConnection = (HttpsURLConnection)url.openConnection();
try {
/* The following works from Eclipse and from the command line, but not from an app with an integrated runtime
* that was produced using jpackage ... */
try {
img = new ImageIcon(ImageIO.read(httpsConnection.getInputStream())
.getScaledInstance(screenSize.width, screenSize.height, Image.SCALE_SMOOTH));
} catch(Exception e) {
System.out.println("went wrong #1 for " + urlName);
e.printStackTrace();
}
} catch(Exception e) {
System.out.println("went wrong #2 for " + urlName);
e.printStackTrace();
}
} catch (MalformedURLException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}
lbl.setIcon(img);
f.getContentPane().add(lbl); //puts label inside the jframe
f.setSize(halfWidth, halfHeight); // set frame size to half of screen ... but need to resize the image
int x = (screenSize.width - f.getSize().width)/2; //These two lines are the dimensions
int y = (screenSize.height - f.getSize().height)/2;//of the center of the screen
f.setLocation(x, y); //sets the location of the jframe
f.setVisible(true); //makes the jframe visible
}
}
以下是调试输出中的几行：
$ /Applications/HelloTest.app/Contents/MacOS/HelloTest ; exit;
javax.net.ssl.trustStore = /Library/Java/JavaVirtualMachines/jdk-15.jdk/Contents/Home/lib/security/cacerts
javax.net.ssl|DEBUG|01|main|2020-09-17 07:27:05.852 CEST|null:-1|System property jdk.tls.client.cipherSuites is set to 'null'
…
javax.net.ssl|DEBUG|01|main|2020-09-17 07:27:06.130 CEST|null:-1|trustStore is: /Library/Java/JavaVirtualMachines/jdk-15.jdk/Contents/Home/lib/security/cacerts
trustStore type is: pkcs12
trustStore provider is:
the last modified time is: Wed Aug 12 02:19:32 CEST 2020
javax.net.ssl|DEBUG|01|main|2020-09-17 07:27:06.131 CEST|null:-1|Reload the trust store
javax.net.ssl|DEBUG|01|main|2020-09-17 07:27:06.283 CEST|null:-1|Reload trust certs
javax.net.ssl|DEBUG|01|main|2020-09-17 07:27:06.286 CEST|null:-1|Reloaded 91 trust certs
javax.net.ssl|DEBUG|01|main|2020-09-17 07:27:06.430 CEST|null:-1|adding as trusted certificates (
"certificate" : {
"version" : "v3",
"serial number" : "00 A6 8B 79 29 00 00 00 00 50 D0 91 F9",
"signature algorithm": "SHA384withECDSA",
"issuer" : "CN=Entrust Root Certification Authority - EC1, OU="(c) 2012 Entrust, Inc. - for authorized use only", OU=See www.entrust.net/legal-terms, O="Entrust, Inc.", C=US",
…
javax.net.ssl|DEBUG|01|main|2020-09-17 07:27:06.445 CEST|null:-1|keyStore is :
javax.net.ssl|DEBUG|01|main|2020-09-17 07:27:06.445 CEST|null:-1|keyStore type is : pkcs12
javax.net.ssl|DEBUG|01|main|2020-09-17 07:27:06.445 CEST|null:-1|keyStore provider is :
javax.net.ssl|ALL|01|main|2020-09-17 07:27:06.445 CEST|null:-1|init keystore
javax.net.ssl|DEBUG|01|main|2020-09-17 07:27:06.446 CEST|null:-1|init keymanager of type SunX509
javax.net.ssl|ALL|01|main|2020-09-17 07:27:06.447 CEST|null:-1|trigger seeding of SecureRandom
javax.net.ssl|ALL|01|main|2020-09-17 07:27:06.449 CEST|null:-1|done seeding of SecureRandom
javax.net.ssl|DEBUG|01|main|2020-09-17 07:27:06.476 CEST|null:-1|System property jdk.tls.client.SignatureSchemes is set to 'null'
javax.net.ssl|WARNING|01|main|2020-09-17 07:27:06.478 CEST|null:-1|Signature algorithm, ed25519, not supported by JSSE
javax.net.ssl|WARNING|01|main|2020-09-17 07:27:06.479 CEST|null:-1|Signature algorithm, ed448, not supported by JSSE
javax.net.ssl|WARNING|01|main|2020-09-17 07:27:06.480 CEST|null:-1|No AlgorithmParameters for x25519 (
"throwable" : {
java.security.NoSuchAlgorithmException: Algorithm x25519 not available
at java.base/javax.crypto.KeyAgreement.getInstance(Unknown Source)
at java.base/sun.security.ssl.NamedGroup.<init>(Unknown Source)
…
javax.net.ssl|ERROR|01|main|2020-09-17 07:27:09.230 CEST|null:-1|Fatal (HANDSHAKE_FAILURE): Received fatal alert: handshake_failure (
"throwable" : {
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
在对我的问题有用的评论之后，这是一个解决问题的示例打包脚本：
detected_modules=`jdeps \
-q \
--ignore-missing-deps \
--print-module-deps \
--class-path "MyApp.jar:../sandbox/jars/*" \
-recursive MyApp.jar \
MyApp/MyApp.class`
echo "detected modules: ${detected_modules}"
manual_modules=jdk.crypto.cryptoki
echo "manual modules: ${manual_modules}"
rm -rf ../runtime
jlink \
--no-header-files \
--no-man-pages \
--compress=2 \
--strip-debug \
--add-modules "${detected_modules},${manual_modules}" \
--output ../runtime
jpackage \
--verbose \
--type pkg \
--input ../sandbox \
--dest ../output \
--name MyApp \
--app-version $1 \
--main-class MyApp.MyApp \
--main-jar MyApp.jar \
--runtime-image ../runtime \
--mac-package-name MyApp