spring-projects/spring-boot · critical · IllegalStateException

SHA-256 is not available

Error message

SHA-256 is not available

What it means

MessageDigest.getInstance("SHA-256") threw NoSuchAlgorithmException while hashing a Docker context name to locate its metadata directory (asHash at line 150). SHA-256 is a mandatory algorithm in every Java SE implementation (JCA spec), so on any compliant JDK this branch is effectively unreachable. It only fires on a stripped or non-compliant runtime that removed the SHA-256 MessageDigest provider.

Source

Thrown at buildpack/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/docker/configuration/DockerConfigurationMetadata.java:157

			DockerContext context = DockerContext.fromJson(readPathContent(metaPath));
			if (tlsPath.toFile().isDirectory()) {
				return context.withTlsPath(tlsPath.toString());
			}
			return context;
		}
		catch (JacksonException ex) {
			throw new IllegalStateException("Error parsing Docker context metadata file '" + metaPath + "'", ex);
		}
	}

	private static String asHash(String currentContext) {
		try {
			MessageDigest digest = MessageDigest.getInstance("SHA-256");
			byte[] hash = digest.digest(currentContext.getBytes(StandardCharsets.UTF_8));
			return HexFormat.of().formatHex(hash);
		}
		catch (NoSuchAlgorithmException ex) {
			throw new IllegalStateException("SHA-256 is not available", ex);
		}
	}

	private static String readPathContent(Path path) {
		try {
			return Files.readString(path);
		}
		catch (IOException ex) {
			throw new IllegalStateException("Error reading Docker configuration file '" + path + "'", ex);
		}
	}

	static final class DockerConfig extends MappedObject {

		private final @Nullable String currentContext;

		private final @Nullable String credsStore;

View on GitHub (pinned to 270dfe353f)

Solutions

1. Run on a stock OpenJDK distribution where SHA-256 is always available.
2. If using jlink, do not exclude jdk.crypto.cryptoki / jdk.crypto.ec and keep the default Security providers.
3. Smoke-test the runtime: confirm `MessageDigest.getInstance("SHA-256")` succeeds in jshell.

// Startup smoke-test for SHA-256 availability
try {
    MessageDigest.getInstance("SHA-256");
} catch (NoSuchAlgorithmException e) {
    throw new IllegalStateException(
        "This JRE does not provide SHA-256; use a stock OpenJDK distribution.", e);
}

When it happens

Trigger: asHash(currentContext) calls MessageDigest.getInstance("SHA-256") and the security subsystem has no provider registered for SHA-256. NoSuchAlgorithmException is caught at line 156 and wrapped.

Common situations: A jlink-built custom runtime image that excluded the crypto providers; a FIPS-hardened JVM that disabled SHA-256; a non-OpenJDK/non-Oracle JVM with an incomplete JCA implementation.

Related errors

• Unable to get X.509 certificate factory
• 'value' must contain a well formed version number [{}]
• Docker API version must be at least %s to support this featu
• Error response received when pushing image: {}
• 'value' [{}] must be in the form 'os[/architecture[/variant]

AI-assisted analysis of spring-projects/spring-boot@270dfe353f (2026-08-11). Data as JSON: /api/errors/2d69d6061c106827. Report an issue: GitHub.