kestra-io/kestra · error · PebbleException

Hashing exception encountered

Error message

Hashing exception encountered

What it means

Thrown by the SHA filter family (sha1, sha256, sha512, etc., all extending ShaBaseFilter) when `MessageDigest.getInstance(algorithm)` or `digest.digest(...)` raises an exception. The original exception is attached as the cause; the message is a generic 'Hashing exception encountered'. On standard JVMs the SHA algorithms are always available, so this branch is essentially only reachable on stripped/custom JCE configurations.

Source

Thrown at core/src/main/java/io/kestra/core/runners/pebble/filters/ShaBaseFilter.java:38

    @Override
    public List<String> getArgumentNames() {
        return null;
    }

    @Override
    public Object apply(Object input, Map<String, Object> args, PebbleTemplate self,
        EvaluationContext context, int lineNumber) throws PebbleException {
        if (input == null) {
            return null;
        }

        if (input instanceof String str) {
            try {
                MessageDigest digest = MessageDigest.getInstance(algorithm);
                byte[] encodedHash = digest.digest((str).getBytes(StandardCharsets.UTF_8));
                return bytesToHex(encodedHash);
            } catch (Exception e) {
                throw new PebbleException(e, "Hashing exception encountered\n", lineNumber, self.getName());
            }
        } else {
            throw new PebbleException(null, "Need a string to hash\n", lineNumber, self.getName());
        }
    }

    private static String bytesToHex(byte[] bytes) {
        StringBuilder hexString = new StringBuilder(2 * bytes.length);
        for (byte aByte : bytes) {
            String hex = Integer.toHexString(0xff & aByte);
            if (hex.length() == 1) {
                hexString.append('0');
            }
            hexString.append(hex);
        }
        return hexString.toString();
    }

View on GitHub (pinned to 823fada927)

Solutions

1. Inspect the wrapped cause in the stack trace (NoSuchAlgorithmException vs other).
2. Run on a standard JDK/JRE that includes the SUN security provider.
3. If using a custom runtime image, ensure the `java.security` provider list includes MessageDigest support for SHA-*.
4. Confirm the algorithm name is correct (e.g. 'SHA-256', not 'SHA256').

Example fix

# before
{{ secret | sha256 }}
# the call is correct; fix the runtime instead:
# use a full JDK/JRE that includes the SUN provider
# verify in a script task:
#   MessageDigest.getInstance("SHA-256") must not throw

# Verify algorithm availability in a script task before relying on the filter:
# MessageDigest.getInstance("SHA-256");  // throws NoSuchAlgorithmException on stripped runtimes
# In Pebble, the call is correct; this is an environment issue:
{{ secret | sha256 }}

# In a script task (Java/Groovy), guard the digest:
# try { MessageDigest.getInstance("SHA-256"); }
# catch (NoSuchAlgorithmException e) { /* fall back to a supported algorithm */ }

When it happens

Trigger: Running on a JVM or security provider that does not register the requested algorithm; a `NoSuchAlgorithmException` or a runtime fault during digesting (extremely rare). Could also occur if a subclass passes an unsupported algorithm string to the constructor.

Common situations: Custom JRE images (e.g. jlink minimised runtime) that exclude the SUN provider; embedded environments with restricted cryptography; a future subclass typo in the algorithm name.

Related errors

• Need a string to hash
• An error occurred while flattening the list.
• The 'jq' filter expects an argument 'expression'.
• Unable to parse jq value '{}' with type '{}'
• 'keys' filter can only be applied to List, Map, Array. Actua

AI-assisted analysis of kestra-io/kestra@823fada927 (2026-08-14). Data as JSON: /api/errors/f4bc5a28ae6a86eb. Report an issue: GitHub.