pentaho/pentaho-kettle · error · KettleStepException

Unable to obtain checksum of UDJC -

Error message

Unable to obtain checksum of UDJC -

What it means

UserDefinedJavaClassDef.getChecksum computes an MD5 over className+source; if MessageDigest.getInstance("MD5") or digest/encoding fails (essentially only when the JRE lacks the MD5 provider), it throws KettleStepException "Unable to obtain checksum of UDJC - <className>". Called by checksum(), used to detect source changes for class recompilation.

Solutions

  1. Run on a standard Oracle/OpenJDK JVM where the MD5 MessageDigest is available.
  2. Remove JVM security restrictions disabling MD5 (java.security configuration / FIPS policy).
  3. If the JVM policy cannot change, patch getChecksum to use an allowed algorithm (e.g. SHA-256).

Example fix

// before
byte[] b = MessageDigest.getInstance( "MD5" ).digest( ck.getBytes() );
// after (when MD5 is unavailable)
byte[] b = MessageDigest.getInstance( "SHA-256" ).digest( ck.getBytes() );
Defensive patterns

Strategy: try-catch

Validate before calling

// verify MD5 availability before running UDJC transformations
try { MessageDigest.getInstance("MD5"); } catch (NoSuchAlgorithmException e) { /* JVM lacks MD5: fix provider or use SHA-256 */ }

Type guard

boolean md5Available() { try { MessageDigest.getInstance("MD5"); return true; } catch (NoSuchAlgorithmException e) { return false; } }

Try / catch

try { String ck = def.checksum(); ... } catch (KettleStepException e) { logError("Cannot checksum UDJC class (JCE policy?): " + e.getMessage()); }

Prevention

When it happens

Trigger: MessageDigest.getInstance("MD5") throwing NoSuchAlgorithmException — a non-standard or stripped JCE provider set — or unexpected exceptions during digest computation.

Common situations: Running on a hardened/custom JVM (e.g. FIPS-configured) where MD5 is disabled; extremely minimal JRE distributions without the standard SunJCE provider.

Understand the failure class

Background: Checksum mismatch errors: "checksum verification failed", "digest mismatch", "expected vs actual checksum" — what they mean and how to fix them — this error's family across 41 libraries.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/413608f1d4b2f244. Report an issue: GitHub.

Appendix: source

Thrown at engine/src/main/java/org/pentaho/di/trans/steps/userdefinedjavaclass/UserDefinedJavaClassDef.java:57

    super();
    this.classType = classType;
    this.className = className;
    this.source = source;
    classActive = true;
  }

  public int hashCode() {
    return Objects.hash( className, source );
  }

  public String getChecksum() throws KettleStepException {
    String ck = this.className + this.source;
    try {
      byte[] b = MessageDigest.getInstance( "MD5" ).digest( ck.getBytes() );
      return Hex.encodeHexString( b );
    } catch ( Exception ex ) {
      // Can't get MD5 hashcode ?
      throw new KettleStepException( "Unable to obtain checksum of UDJC - " + this.className );
    }
  }

  public ClassType getClassType() {
    return classType;
  }

  public void setClassType( ClassType classType ) {
    this.classType = classType;
  }

  public String getSource() {
    return this.source;
  }

  public Object clone() throws CloneNotSupportedException {
    return super.clone();
  }

View on GitHub (pinned to f3058517a1)