{"record":{"id":"4f94e77b34592ea0","repo":"GoogleContainerTools/jib","slug":"sha-256-algorithm-implementation-not-found-might-4f94e7","errorCode":null,"errorMessage":"SHA-256 algorithm implementation not found - might be a broken JVM","messagePattern":"SHA-256 algorithm implementation not found - might be a broken JVM","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"critical","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/hash/CountingDigestOutputStream.java","lineNumber":45,"sourceCode":"\n/** A {@link DigestOutputStream} that also keeps track of the total number of bytes written. */\npublic class CountingDigestOutputStream extends DigestOutputStream {\n\n  private static final String SHA_256_ALGORITHM = \"SHA-256\";\n\n  private long bytesSoFar = 0;\n\n  /**\n   * Wraps the {@code outputStream}.\n   *\n   * @param outputStream the {@link OutputStream} to wrap.\n   */\n  public CountingDigestOutputStream(OutputStream outputStream) {\n    super(outputStream, null);\n    try {\n      setMessageDigest(MessageDigest.getInstance(SHA_256_ALGORITHM));\n    } catch (NoSuchAlgorithmException ex) {\n      throw new RuntimeException(\n          \"SHA-256 algorithm implementation not found - might be a broken JVM\");\n    }\n  }\n\n  /**\n   * Computes the hash and returns it along with the size of the bytes written to compute the hash.\n   * The buffer resets after this method is called, so this method should only be called once per\n   * computation.\n   *\n   * @return the computed hash and the size of the bytes consumed\n   */\n  public BlobDescriptor computeDigest() {\n    try {\n      byte[] hashedBytes = digest.digest();\n\n      // Encodes each hashed byte into 2-character hexadecimal representation.\n      StringBuilder stringBuilder = new StringBuilder(2 * hashedBytes.length);\n      for (byte b : hashedBytes) {","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/hash/CountingDigestOutputStream.java#L27-L63","documentation":"CountingDigestOutputStream computes SHA-256 digests while bytes are written (used for layer/blob descriptors). At construction it requests MessageDigest.getInstance(\"SHA-256\"); if the JVM lacks that algorithm it throws this RuntimeException. A JVM without SHA-256 is fundamentally broken — every modern JVM ships it.","triggerScenarios":"Constructing CountingDigestOutputStream on a JVM/runtime where the JCA provider does not register SHA-256 — e.g. a stripped-down/forked JVM, a broken JCE provider configuration, or severely restricted security properties.","commonSituations":"Exotic/minimal JREs or GraalVM native-image misconfigurations, corporate JVM images with modified java.security files, custom Security.removeProvider calls.","solutions":["Use a standard, unmodified JVM (Temurin, Zulu, etc.) — SHA-256 is required by spec","Inspect java.security / registered security providers for tampering","Check for Security.removeProvider(\"SUN\") or similar in your code/frameworks","Reinstall the JDK if the JCE configuration is corrupt"],"exampleFix":"// before\n// custom JVM with stripped providers\njava -XX:+... MyApp\n// after\n// standard JVM\n/path/to/temurin-17/bin/java -jar myapp.jar","handlingStrategy":"try-catch","validationCode":"try { java.security.MessageDigest.getInstance(\"SHA-256\"); } catch (java.security.NoSuchAlgorithmException e) { throw new IllegalStateException(\"JVM lacks SHA-256; use a standard JDK\", e); }","typeGuard":"boolean jvmSupportsSha256() { try { javax.crypto.Mac.getInstance(\"HmacSHA256\"); return java.security.MessageDigest.getInstance(\"SHA-256\") != null; } catch (Exception e) { return false; } }","tryCatchPattern":"try { jibStep(); } catch (RuntimeException e) { if (e.getMessage().contains(\"SHA-256 algorithm implementation not found\")) { failBuild(\"Replace broken JVM with standard JDK\"); } throw e; }","preventionTips":["Use vendor-standard JDKs (Temurin, Zulu, Corretto)","Do not call Security.removeProvider or heavily edit java.security","Smoke-test MessageDigest.getInstance(\"SHA-256\") at app startup in constrained environments"],"tags":["jvm","security","sha-256","digest"],"backgroundTag":"broken-jvm-provider","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}