{"record":{"id":"ab3ad9abd67ccb8b","repo":"apache/flink","slug":"jar-file-can-t-be-read","errorCode":null,"errorMessage":"JAR file can't be read '{}'","messagePattern":"JAR file can't be read '(.+?)'","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"flink-core/src/main/java/org/apache/flink/util/JarUtils.java","lineNumber":49,"sourceCode":"import java.util.jar.JarFile;\nimport java.util.stream.Collectors;\n\n/** Utility functions for jar files. */\n@Internal\npublic class JarUtils {\n\n    public static void checkJarFile(URL jar) throws IOException {\n        File jarFile;\n        try {\n            jarFile = new File(jar.toURI());\n        } catch (URISyntaxException e) {\n            throw new IOException(\"JAR file path is invalid '\" + jar + '\\'');\n        }\n        if (!jarFile.exists()) {\n            throw new IOException(\"JAR file does not exist '\" + jarFile.getAbsolutePath() + '\\'');\n        }\n        if (!jarFile.canRead()) {\n            throw new IOException(\"JAR file can't be read '\" + jarFile.getAbsolutePath() + '\\'');\n        }\n\n        try (JarFile ignored = new JarFile(jarFile)) {\n            // verify that we can open the Jar file\n        } catch (IOException e) {\n            throw new IOException(\n                    \"Error while opening jar file '\" + jarFile.getAbsolutePath() + '\\'', e);\n        }\n    }\n\n    public static List<URL> getJarFiles(final String[] jars) {\n        if (jars == null) {\n            return Collections.emptyList();\n        }\n\n        return Arrays.stream(jars)\n                .map(\n                        jarPath -> {","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/apache/flink/blob/2f3c205e9266cb30240eb7f4fdab15cad629a70f/flink-core/src/main/java/org/apache/flink/util/JarUtils.java#L31-L67","documentation":"The third existence/readability check in JarUtils.checkJarFile: the file at the jar URL exists, but File.canRead() returns false, so the process cannot open it. This IOException reports the absolute path of the unreadable file.","triggerScenarios":"Calling JarUtils.checkJarFile with a URL to an existing file whose POSIX permissions deny read access to the current user (no 'r' bit for the Flink process owner), or a file owned by root with restrictive mode while Flink runs as a non-root user.","commonSituations":"Jar placed by root with chmod 600 and Flink runs as user 'flink'; security-hardened cluster images stripping read bits from dependency jars; files on an NFS mount with root_squash changing effective permissions.","solutions":["Fix permissions on the file: chmod a+r /path/to.jar (or chown it to the Flink service user).","Check parent directory traversal rights (execute bit on each directory component).","Confirm which OS user the JobManager/TaskManager runs as and grant that user read access.","Re-copy the jar with the service account instead of root to avoid ownership mismatch."],"exampleFix":"# before\n-rw------- 1 root root 64M /opt/jars/my-connector.jar   # flink user cannot read\n\n# after\nchmod a+r /opt/jars/my-connector.jar\n# or: chown flink:flink /opt/jars/my-connector.jar","handlingStrategy":"validation","validationCode":"Path p = Paths.get(jarUrl.toURI());\nif (!Files.isReadable(p)) {\n    throw new AccessDeniedException(\"No read access to jar: \" + p + \" (run as owner or chmod a+r)\");\n}\nJarUtils.checkJarFile(jarUrl);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set chmod a+r on shared dependency jars","Ensure the Flink service user owns or can read all referenced jars","Check directory execute bits when jars live in nested directories"],"tags":["jar","permissions","filesystem","deployment"],"backgroundTag":null,"analyzedSha":"2f3c205e9266cb30240eb7f4fdab15cad629a70f","analyzedAt":"2026-08-14T08:48:24.518Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}