GoogleContainerTools/jib · error · RuntimeException

SHA-256 algorithm implementation not found - might be a brok

Error message

SHA-256 algorithm implementation not found - might be a broken JVM

What it means

When hashing the project path, Jib requests the SHA-256 MessageDigest from the JVM. If MessageDigest.getInstance("SHA-256") throws NoSuchAlgorithmException, the CLI throws this RuntimeException, indicating the JVM's security provider set is broken or missing SHA-256.

Source

Thrown at jib-cli/src/main/java/com/google/cloud/tools/jib/cli/CacheDirectories.java:81

  @VisibleForTesting
  static String getProjectCacheDirectoryFromProject(Path path) {
    try {
      byte[] hashedBytes =
          MessageDigest.getInstance("SHA-256")
              .digest(path.toFile().getCanonicalPath().getBytes(Charsets.UTF_8));
      StringBuilder stringBuilder = new StringBuilder(2 * hashedBytes.length);
      for (byte b : hashedBytes) {
        stringBuilder.append(String.format("%02x", b));
      }
      return stringBuilder.toString();
    } catch (IOException | SecurityException ex) {
      throw new RuntimeException(
          "Unable to create cache directory for project path: "
              + path
              + " - you can try to configure --project-cache manually",
          ex);
    } catch (NoSuchAlgorithmException ex) {
      throw new RuntimeException(
          "SHA-256 algorithm implementation not found - might be a broken JVM");
    }
  }

  public CacheDirectories(@Nullable Path baseImageCache, Path projectCache) {
    this.baseImageCache = baseImageCache;
    this.projectCache = projectCache;
  }

  public Optional<Path> getBaseImageCache() {
    return Optional.ofNullable(baseImageCache);
  }

  public Path getProjectCache() {
    return projectCache;
  }

  public Path getApplicationLayersCache() {

View on GitHub (pinned to fb949e2676)

Solutions

Run Jib CLI with a standard JDK/JRE that includes the default SUN security provider.
If using jlink, include jdk.crypto.ec/jdk.crypto.cryptoki modules in the custom runtime.
Check java.security configuration for removed security providers and restore the default set.

Defensive patterns

Strategy: validation

Validate before calling

try {
  java.security.MessageDigest.getInstance("SHA-256");
} catch (java.security.NoSuchAlgorithmException e) {
  throw new IllegalStateException("JVM lacks SHA-256; use a standard JDK", e);
}

Prevention

Use a standard JDK/JRE distribution for Jib CLI
If using jlink, include jdk.crypto.* modules
Avoid removing default security providers in java.security

When it happens

Trigger: getProjectCacheDirectoryFromProject (via from) calling MessageDigest.getInstance("SHA-256") on a JVM whose providers do not include SHA-256 (custom JRE built with jlink stripped of crypto providers, or a provider-removal misconfiguration).

Common situations: Custom jlink-minimized runtimes lacking jdk.crypto modules, exotic/trimmed JVM distributions, security provider overridden in java.security config.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/1ec5f4cda66d723e. Report an issue: GitHub.