{"record":{"id":"44e09907807e1ab5","repo":"apache/druid","slug":"unable-to-get-sha1-digest-instance","errorCode":null,"errorMessage":"Unable to get SHA1 digest instance","messagePattern":"Unable to get SHA1 digest instance","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"processing/src/main/java/org/apache/druid/query/aggregation/JavaScriptAggregatorFactory.java","lineNumber":246,"sourceCode":"    return fieldNames;\n  }\n\n  @Override\n  public byte[] getCacheKey()\n  {\n    try {\n      MessageDigest md = MessageDigest.getInstance(\"SHA-1\");\n      byte[] fieldNameBytes = StringUtils.toUtf8(Joiner.on(\",\").join(fieldNames));\n      byte[] sha1 = md.digest(StringUtils.toUtf8(fnAggregate + fnReset + fnCombine));\n\n      return ByteBuffer.allocate(1 + fieldNameBytes.length + sha1.length)\n                       .put(AggregatorUtil.JS_CACHE_TYPE_ID)\n                       .put(fieldNameBytes)\n                       .put(sha1)\n                       .array();\n    }\n    catch (NoSuchAlgorithmException e) {\n      throw new RuntimeException(\"Unable to get SHA1 digest instance\", e);\n    }\n  }\n\n  @Override\n  public ColumnType getIntermediateType()\n  {\n    return ColumnType.FLOAT;\n  }\n\n  @Override\n  public ColumnType getResultType()\n  {\n    return ColumnType.FLOAT;\n  }\n\n  @Override\n  public int getMaxIntermediateSize()\n  {","sourceCodeStart":228,"sourceCodeEnd":264,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/processing/src/main/java/org/apache/druid/query/aggregation/JavaScriptAggregatorFactory.java#L228-L264","documentation":"JavaScriptAggregatorFactory.getCacheKey computes a SHA-1 digest of the aggregator's configuration to build a stable cache key. It requests a MessageDigest instance for algorithm \"SHA1\" from the JCA provider; if no provider supplies SHA1, NoSuchAlgorithmException is thrown and rethrown as a RuntimeException with the message \"Unable to get SHA1 digest instance\". In a normal JVM this never happens because every conforming JDK includes SHA1 in its default provider set.","triggerScenarios":"Invoking getCacheKey() on a JavaScriptAggregatorFactory while running on a JVM whose security providers were stripped of SHA1/MessageDigest support, or with a restricted JCE policy / custom Provider list that removes the SUN provider. The call occurs whenever query result caching is used (broker populates/populates cache keys for aggregators).","commonSituations":"Hardened or FIPS-only JVM configurations where SHA1 is deliberately disabled; custom java.security provider registrations that remove the default SUN provider; running on a nonstandard/minimal JRE (e.g. stripped module image) lacking the JCA MessageDigest implementation.","solutions":["Restore the default JCA providers: remove java.security security provider overrides that exclude SUN, or add a provider that supplies SHA1 MessageDigest.","Check that the JVM/JRE image includes java.base security modules (java.security.MessageDigest, SUN provider); use a full JDK distribution.","If FIPS policy blocks SHA1 for MessageDigest (as opposed to signatures), allow SHA1 for digest-only use or configure the provider accordingly.","Disable or bypass query result caching so getCacheKey is not invoked while the environment is being fixed."],"exampleFix":"// before: stripped providers in java.security\n// security.provider.1=org.bouncycastle.jce.provider.BouncyCastleProvider  (no SUN, no SHA1 MessageDigest)\n// after: keep the default SUN provider which supplies SHA1\n// security.provider.1=sun.security.provider.Sun\n// security.provider.2=org.bouncycastle.jce.provider.BouncyCastleProvider","handlingStrategy":"try-catch","validationCode":"// verify SHA1 MessageDigest is available before enabling caching paths\ntry {\n  java.security.MessageDigest.getInstance(\"SHA1\");\n} catch (java.security.NoSuchAlgorithmException e) {\n  throw new IllegalStateException(\"JVM is missing SHA1 MessageDigest; query result caching will fail\", e);\n}","typeGuard":null,"tryCatchPattern":"try {\n  byte[] cacheKey = (byte[]) factory.getCacheKey();\n} catch (RuntimeException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"Unable to get SHA1 digest instance\")) {\n    log.error(e, \"JCA provider cannot supply SHA1; fix java.security providers\");\n    // disable caching and rethrow as configuration error\n  }\n  throw e;\n}","preventionTips":["Do not remove the default SUN security provider from java.security when hardening the JVM.","Smoke-test that MessageDigest.getInstance(\"SHA1\") works at startup on hardened/FIPS images.","Use standard full JDK distributions rather than minimal stripped JREs for Druid services.","If FIPS compliance forbids SHA1, plan Druid version/configuration accordingly rather than disabling providers at runtime."],"tags":["druid","aggregation","javascript","cache","jvm","sha1"],"backgroundTag":"unsupported-operation","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}