{"record":{"id":"2d69d6061c106827","repo":"spring-projects/spring-boot","slug":"sha-256-is-not-available","errorCode":null,"errorMessage":"SHA-256 is not available","messagePattern":"SHA-256 is not available","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"critical","filePath":"buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/configuration/DockerConfigurationMetadata.java","lineNumber":157,"sourceCode":"\t\t\tDockerContext context = DockerContext.fromJson(readPathContent(metaPath));\n\t\t\tif (tlsPath.toFile().isDirectory()) {\n\t\t\t\treturn context.withTlsPath(tlsPath.toString());\n\t\t\t}\n\t\t\treturn context;\n\t\t}\n\t\tcatch (JacksonException ex) {\n\t\t\tthrow new IllegalStateException(\"Error parsing Docker context metadata file '\" + metaPath + \"'\", ex);\n\t\t}\n\t}\n\n\tprivate static String asHash(String currentContext) {\n\t\ttry {\n\t\t\tMessageDigest digest = MessageDigest.getInstance(\"SHA-256\");\n\t\t\tbyte[] hash = digest.digest(currentContext.getBytes(StandardCharsets.UTF_8));\n\t\t\treturn HexFormat.of().formatHex(hash);\n\t\t}\n\t\tcatch (NoSuchAlgorithmException ex) {\n\t\t\tthrow new IllegalStateException(\"SHA-256 is not available\", ex);\n\t\t}\n\t}\n\n\tprivate static String readPathContent(Path path) {\n\t\ttry {\n\t\t\treturn Files.readString(path);\n\t\t}\n\t\tcatch (IOException ex) {\n\t\t\tthrow new IllegalStateException(\"Error reading Docker configuration file '\" + path + \"'\", ex);\n\t\t}\n\t}\n\n\tstatic final class DockerConfig extends MappedObject {\n\n\t\tprivate final @Nullable String currentContext;\n\n\t\tprivate final @Nullable String credsStore;\n","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/spring-projects/spring-boot/blob/270dfe353fb830fd69b823a8a859287ff103854b/buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/configuration/DockerConfigurationMetadata.java#L139-L175","documentation":"MessageDigest.getInstance(\"SHA-256\") threw NoSuchAlgorithmException while hashing a Docker context name to locate its metadata directory (asHash at line 150). SHA-256 is a mandatory algorithm in every Java SE implementation (JCA spec), so on any compliant JDK this branch is effectively unreachable. It only fires on a stripped or non-compliant runtime that removed the SHA-256 MessageDigest provider.","triggerScenarios":"asHash(currentContext) calls MessageDigest.getInstance(\"SHA-256\") and the security subsystem has no provider registered for SHA-256. NoSuchAlgorithmException is caught at line 156 and wrapped.","commonSituations":"A jlink-built custom runtime image that excluded the crypto providers; a FIPS-hardened JVM that disabled SHA-256; a non-OpenJDK/non-Oracle JVM with an incomplete JCA implementation.","solutions":["Run on a stock OpenJDK distribution where SHA-256 is always available.","If using jlink, do not exclude jdk.crypto.cryptoki / jdk.crypto.ec and keep the default Security providers.","Smoke-test the runtime: confirm `MessageDigest.getInstance(\"SHA-256\")` succeeds in jshell."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Startup smoke-test for SHA-256 availability\ntry {\n    MessageDigest.getInstance(\"SHA-256\");\n} catch (NoSuchAlgorithmException e) {\n    throw new IllegalStateException(\n        \"This JRE does not provide SHA-256; use a stock OpenJDK distribution.\", e);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run on a stock OpenJDK distribution; SHA-256 is mandatory in the JCA spec.","If building a custom runtime with jlink, do not exclude the default security providers.","Smoke-test crypto providers in your container image build pipeline."],"tags":["java","security","jre","buildpack"],"backgroundTag":null,"analyzedSha":"270dfe353fb830fd69b823a8a859287ff103854b","analyzedAt":"2026-08-11T19:42:06.541Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}