{"record":{"id":"f5e01c0c7c1fa8be","repo":"oracle/graal","slug":"sealing-violation-package-s-is-sealed","errorCode":null,"errorMessage":"Sealing violation: package %s is sealed","messagePattern":"Sealing violation: package (.+?) is sealed","errorType":"exception","errorClass":"SecurityException","httpStatus":null,"severity":"error","filePath":"compiler/src/jdk.graal.compiler.hostvmaccess/src/jdk/graal/compiler/hostvmaccess/HostVMAccessClassLoader.java","lineNumber":501,"sourceCode":"            CodeSource cs = new CodeSource(url, signers);\n            return defineClass(name, bb, cs);\n        } else {\n            byte[] b = res.getBytes();\n            CodeSigner[] signers = res.getCodeSigners();\n            CodeSource cs = new CodeSource(url, signers);\n            return defineClass(name, b, 0, b.length, cs);\n        }\n    }\n\n    /**\n     * See {@code java.net.URLClassLoader#getAndVerifyPackage}.\n     */\n    private Package getAndVerifyPackage(String pkgname, Manifest man, URL url) {\n        Package pkg = getDefinedPackage(pkgname);\n        if (pkg != null) {\n            if (pkg.isSealed()) {\n                if (!pkg.isSealed(url)) {\n                    throw new SecurityException(\"Sealing violation: package \" + pkgname + \" is sealed\");\n                }\n            } else {\n                if ((man != null) && isSealed(pkgname, man)) {\n                    throw new SecurityException(\"Sealing violation: can't seal package \" + pkgname + \": already loaded\");\n                }\n            }\n        }\n        return pkg;\n    }\n\n    /**\n     * See {@code java.net.URLClassLoader#definePackage}.\n     */\n    private Package definePackage(String name, Manifest man, URL url) {\n        String specTitle = null;\n        String specVersion = null;\n        String specVendor = null;\n        String implTitle = null;","sourceCodeStart":483,"sourceCodeEnd":519,"githubUrl":"https://github.com/oracle/graal/blob/a66e9ccd1d7bf2552883939aa0788dfd0e294aab/compiler/src/jdk.graal.compiler.hostvmaccess/src/jdk/graal/compiler/hostvmaccess/HostVMAccessClassLoader.java#L483-L519","documentation":"Ported from java.net.URLClassLoader.getAndVerifyPackage: when defining a class, the loader checks the package it belongs to. If the package is already sealed (Sealed attribute in the manifest of the jar that first defined it) and the new class comes from a different code source URL, this SecurityException is thrown — a sealed package may not be extended from another jar.","triggerScenarios":"A class-path jar's manifest seals package P (Sealed: true); a later class from a different class-path entry tries to define another class in the same package P. getAndVerifyPackage detects pkg.isSealed() && !pkg.isSealed(url).","commonSituations":"Two jars on the image-build class path sharing a package where one seals it (common with signed vendor jars and 'patch' jars that add classes to the vendor's package); deploying a newer version fragment alongside an older sealed jar.","solutions":["Remove the duplicate/patch jar that adds classes to the sealed package","Un-seal the package: edit the first jar's manifest (remove 'Sealed: true') if you own it","Repackage the extra classes under a different package name"],"exampleFix":"# before\nclasspath: vendor-core.jar        # manifest: Sealed: true for com.vendor.pkg\nclasspath: vendor-patch.jar      # adds com.vendor.pkg.Extra -> SecurityException\n\n# after\nclasspath: vendor-core.jar       # patch removed; Extra moved to com.vendor.patchpkg","handlingStrategy":"validation","validationCode":"static void checkNoSealedConflict(List<Path> classpath) throws IOException {\n    Map<String, Boolean> sealed = new HashMap<>();\n    for (Path jar : classpath) {\n        try (JarFile jf = new JarFile(jar.toFile())) {\n            Manifest man = jf.getManifest();\n            if (man == null) continue;\n            Attributes main = man.getMainAttributes();\n            boolean jarSealed = Boolean.parseBoolean(main.getValue(\"Sealed\"));\n            for (String attrName : new String[]{\"Sealed\"}) { /* also per-entry attrs */ }\n            // record package->sealed and detect cross-jar conflicts for shared packages\n        }\n    }\n}","typeGuard":null,"tryCatchPattern":"catch (SecurityException e) { if (e.getMessage().contains(\"is sealed\")) { identify the two jars sharing the package from your class path order and remove the patch jar; } }","preventionTips":["Never add classes to a third-party sealed package via a patch jar","Audit manifests (Sealed attribute) when merging class paths in build tooling","Keep one jar per package family on the image-build class path"],"tags":["graalvm","classpath","sealed-package","security","jars"],"backgroundTag":null,"analyzedSha":"a66e9ccd1d7bf2552883939aa0788dfd0e294aab","analyzedAt":"2026-08-14T13:58:47.161Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}