GoogleContainerTools/jib · critical · RuntimeException

SHA-256 algorithm implementation not found - might be a brok

Error message

SHA-256 algorithm implementation not found - might be a broken JVM

What it means

CountingDigestOutputStream computes SHA-256 digests while bytes are written (used for layer/blob descriptors). At construction it requests MessageDigest.getInstance("SHA-256"); if the JVM lacks that algorithm it throws this RuntimeException. A JVM without SHA-256 is fundamentally broken — every modern JVM ships it.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/hash/CountingDigestOutputStream.java:45

/** A {@link DigestOutputStream} that also keeps track of the total number of bytes written. */
public class CountingDigestOutputStream extends DigestOutputStream {

  private static final String SHA_256_ALGORITHM = "SHA-256";

  private long bytesSoFar = 0;

  /**
   * Wraps the {@code outputStream}.
   *
   * @param outputStream the {@link OutputStream} to wrap.
   */
  public CountingDigestOutputStream(OutputStream outputStream) {
    super(outputStream, null);
    try {
      setMessageDigest(MessageDigest.getInstance(SHA_256_ALGORITHM));
    } catch (NoSuchAlgorithmException ex) {
      throw new RuntimeException(
          "SHA-256 algorithm implementation not found - might be a broken JVM");
    }
  }

  /**
   * Computes the hash and returns it along with the size of the bytes written to compute the hash.
   * The buffer resets after this method is called, so this method should only be called once per
   * computation.
   *
   * @return the computed hash and the size of the bytes consumed
   */
  public BlobDescriptor computeDigest() {
    try {
      byte[] hashedBytes = digest.digest();

      // Encodes each hashed byte into 2-character hexadecimal representation.
      StringBuilder stringBuilder = new StringBuilder(2 * hashedBytes.length);
      for (byte b : hashedBytes) {

View on GitHub (pinned to fb949e2676)

Solutions

1. Use a standard, unmodified JVM (Temurin, Zulu, etc.) — SHA-256 is required by spec
2. Inspect java.security / registered security providers for tampering
3. Check for Security.removeProvider("SUN") or similar in your code/frameworks
4. Reinstall the JDK if the JCE configuration is corrupt

Example fix

// before
// custom JVM with stripped providers
java -XX:+... MyApp
// after
// standard JVM
/path/to/temurin-17/bin/java -jar myapp.jar

try { java.security.MessageDigest.getInstance("SHA-256"); } catch (java.security.NoSuchAlgorithmException e) { throw new IllegalStateException("JVM lacks SHA-256; use a standard JDK", e); }

boolean jvmSupportsSha256() { try { javax.crypto.Mac.getInstance("HmacSHA256"); return java.security.MessageDigest.getInstance("SHA-256") != null; } catch (Exception e) { return false; } }

try { jibStep(); } catch (RuntimeException e) { if (e.getMessage().contains("SHA-256 algorithm implementation not found")) { failBuild("Replace broken JVM with standard JDK"); } throw e; }

When it happens

Trigger: Constructing CountingDigestOutputStream on a JVM/runtime where the JCA provider does not register SHA-256 — e.g. a stripped-down/forked JVM, a broken JCE provider configuration, or severely restricted security properties.

Common situations: Exotic/minimal JREs or GraalVM native-image misconfigurations, corporate JVM images with modified java.security files, custom Security.removeProvider calls.

Related errors

• SHA-256 algorithm produced invalid hash: + ex.getMessage()
• SHA-256 algorithm implementation not found - might be a brok
• Invalid hash: ${hash}
• Invalid digest: ${digest}
• Layer file did not include valid hash: <layerFile>

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/4f94e77b34592ea0. Report an issue: GitHub.