Signing your jars? Please declare them!

A while ago, Sandra and I were working on the p2-maven-plugin, which helps you create Eclipse RCP projects via maven means. One of the tasks we faces was updating the Tycho dependency which is used to actually package and bundle the project.

Origin of updating the p2-maven-plugin

In January, I was asked to contribute to the p2-maven-plugin (thanks Andres for thinking of me!). While I did not think I knew tycho/eclipse RCP enough to be of real value here, they specifically asked for me helping out in some maven project maintenance.

👋 @tombujok

If there's still work to be done on the p2-maven-plugin and there's no one working on it perhaps a co-lead or transferring ownership might help

+@bmarwell
— Andres Almiray (@aalmiray) January 26, 2021

In the end I got persuaded to help out a little. ;-)

Updating tycho: Invalid signature

Now what you least expect when updating a dependency: You use all correct transient dependencies (via dependency management) and still get a signing exception:

[WARNING] Error injecting: org.eclipse.tycho.core.locking.FileLockServiceImpl

com.google.inject.ProvisionException: Unable to provision, see the following errors:

1) Error injecting constructor, java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
  at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init>(Unknown Source)
  while locating org.eclipse.tycho.core.locking.FileLockServiceImpl

1 error
    at com.google.inject.internal.InternalProvisionException.toProvisionException (InternalProvisionException.java:226)
    at com.google.inject.internal.InjectorImpl$1.get (InjectorImpl.java:1053)
    at com.google.inject.internal.InjectorImpl.getInstance (InjectorImpl.java:1086)
    at org.eclipse.sisu.space.AbstractDeferredClass.get (AbstractDeferredClass.java:48)
    at com.google.inject.internal.ProviderInternalFactory.provision (ProviderInternalFactory.java:85)
    […]
Caused by: java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
    at java.lang.ClassLoader.checkPackageSigners (ClassLoader.java:575)
    at java.lang.ClassLoader.defineClassInternal (ClassLoader.java:468)
    at java.lang.ClassLoader.defineClass (ClassLoader.java:442)
    at java.security.SecureClassLoader.defineClass (SecureClassLoader.java:174)
    at java.net.URLClassLoader.defineClass (URLClassLoader.java:688)
    at java.net.URLClassLoader$ClassFinder.run (URLClassLoader.java:1093)
    at java.net.URLClassLoader$ClassFinder.run (URLClassLoader.java:1078)
    at java.security.AccessController.doPrivileged (AccessController.java:770)
    at java.net.URLClassLoader.findClass (URLClassLoader.java:603)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClassFromSelf (ClassRealm.java:425)
    at org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy.loadClass (SelfFirstStrategy.java:42)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.unsynchronizedLoadClass (ClassRealm.java:271)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass (ClassRealm.java:247)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass (ClassRealm.java:239)
    at org.eclipse.osgi.internal.log.EquinoxLogServices.<init> (EquinoxLogServices.java:94)
    at org.eclipse.osgi.internal.framework.EquinoxContainer.<init> (EquinoxContainer.java:90)
    at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init> (FileLockServiceImpl.java:32)
    […]
[WARNING] Error injecting: org.eclipse.tycho.core.osgitools.DefaultBundleReader
com.google.inject.ProvisionException: Unable to provision, see the following errors:

1) Error injecting constructor, java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
  at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init>(Unknown Source)
  while locating org.eclipse.tycho.core.locking.FileLockServiceImpl
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.tycho.locking.facade.FileLockService
  while locating org.eclipse.tycho.core.osgitools.DefaultBundleReader

1 error
    at com.google.inject.internal.InternalProvisionException.toProvisionException (InternalProvisionException.java:226)
    at com.google.inject.internal.InjectorImpl$1.get (InjectorImpl.java:1053)
    at com.google.inject.internal.InjectorImpl.getInstance (InjectorImpl.java:1086)
    at org.eclipse.sisu.space.AbstractDeferredClass.get (AbstractDeferredClass.java:48)
    at com.google.inject.internal.ProviderInternalFactory.provision (ProviderInternalFactory.java:85)
    […]
Caused by: java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
    at java.lang.ClassLoader.checkPackageSigners (ClassLoader.java:575)
    at java.lang.ClassLoader.defineClassInternal (ClassLoader.java:468)
    at java.lang.ClassLoader.defineClass (ClassLoader.java:442)
    at java.security.SecureClassLoader.defineClass (SecureClassLoader.java:174)
    at java.net.URLClassLoader.defineClass (URLClassLoader.java:688)
    at java.net.URLClassLoader$ClassFinder.run (URLClassLoader.java:1093)
    at java.net.URLClassLoader$ClassFinder.run (URLClassLoader.java:1078)
    at java.security.AccessController.doPrivileged (AccessController.java:770)
    at java.net.URLClassLoader.findClass (URLClassLoader.java:603)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClassFromSelf (ClassRealm.java:425)
    at org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy.loadClass (SelfFirstStrategy.java:42)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.unsynchronizedLoadClass (ClassRealm.java:271)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass (ClassRealm.java:247)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass (ClassRealm.java:239)
    at org.eclipse.osgi.internal.log.EquinoxLogServices.<init> (EquinoxLogServices.java:94)
    at org.eclipse.osgi.internal.framework.EquinoxContainer.<init> (EquinoxContainer.java:90)
    at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init> (FileLockServiceImpl.java:32)
    […]
[WARNING] Error injecting: org.eclipse.sisu.equinox.launching.internal.DefaultEquinoxInstallationFactory
com.google.inject.ProvisionException: Unable to provision, see the following errors:

1) Error injecting constructor, java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
  at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init>(Unknown Source)
  while locating org.eclipse.tycho.core.locking.FileLockServiceImpl
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.tycho.locking.facade.FileLockService
  while locating org.eclipse.tycho.core.osgitools.DefaultBundleReader
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.tycho.core.osgitools.BundleReader
  while locating org.eclipse.sisu.equinox.launching.internal.DefaultEquinoxInstallationFactory

1 error
    at com.google.inject.internal.InternalProvisionException.toProvisionException (InternalProvisionException.java:226)
    at com.google.inject.internal.InjectorImpl$1.get (InjectorImpl.java:1053)
    at com.google.inject.internal.InjectorImpl.getInstance (InjectorImpl.java:1086)
    at org.eclipse.sisu.space.AbstractDeferredClass.get (AbstractDeferredClass.java:48)
    at com.google.inject.internal.ProviderInternalFactory.provision (ProviderInternalFactory.java:85)
    at com.google.inject.internal.InternalFactoryToInitializableAdapter.provision (InternalFactoryToInitializableAdapter.java:57)
    at com.google.inject.internal.ProviderInternalFactory$1.call (ProviderInternalFactory.java:66)
    at com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (ProvisionListenerStackCallback.java:112)
    at org.eclipse.sisu.bean.BeanScheduler$CycleActivator.onProvision (BeanScheduler.java:230)
    at com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (ProvisionListenerStackCallback.java:120)
    at com.google.inject.internal.ProvisionListenerStackCallback.provision (ProvisionListenerStackCallback.java:66)
    at com.google.inject.internal.ProviderInternalFactory.circularGet (ProviderInternalFactory.java:61)
    at com.google.inject.internal.InternalFactoryToInitializableAdapter.get (InternalFactoryToInitializableAdapter.java:47)
    at com.google.inject.internal.ProviderToInternalFactoryAdapter.get (ProviderToInternalFactoryAdapter.java:40)
    at com.google.inject.internal.SingletonScope$1.get (SingletonScope.java:168)
    at com.google.inject.internal.InternalFactoryToProviderAdapter.get (InternalFactoryToProviderAdapter.java:39)
    at com.google.inject.internal.InjectorImpl$1.get (InjectorImpl.java:1050)
    at org.eclipse.sisu.inject.LazyBeanEntry.getValue (LazyBeanEntry.java:81)
    at org.eclipse.sisu.plexus.LazyPlexusBean.getValue (LazyPlexusBean.java:51)
    at org.eclipse.sisu.plexus.PlexusRequirements$RequirementProvider.get (PlexusRequirements.java:250)
    at org.eclipse.sisu.plexus.ProvidedPropertyBinding.injectProperty (ProvidedPropertyBinding.java:48)
    at org.eclipse.sisu.bean.BeanInjector.injectMembers (BeanInjector.java:52)
    […]
Caused by: java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
    at java.lang.ClassLoader.checkPackageSigners (ClassLoader.java:575)
    at java.lang.ClassLoader.defineClassInternal (ClassLoader.java:468)
    at java.lang.ClassLoader.defineClass (ClassLoader.java:442)
    at java.security.SecureClassLoader.defineClass (SecureClassLoader.java:174)
    at java.net.URLClassLoader.defineClass (URLClassLoader.java:688)
    at java.net.URLClassLoader$ClassFinder.run (URLClassLoader.java:1093)
    at java.net.URLClassLoader$ClassFinder.run (URLClassLoader.java:1078)
    at java.security.AccessController.doPrivileged (AccessController.java:770)
    at java.net.URLClassLoader.findClass (URLClassLoader.java:603)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClassFromSelf (ClassRealm.java:425)
    at org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy.loadClass (SelfFirstStrategy.java:42)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.unsynchronizedLoadClass (ClassRealm.java:271)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass (ClassRealm.java:247)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass (ClassRealm.java:239)
    at org.eclipse.osgi.internal.log.EquinoxLogServices.<init> (EquinoxLogServices.java:94)
    at org.eclipse.osgi.internal.framework.EquinoxContainer.<init> (EquinoxContainer.java:90)
    at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init> (FileLockServiceImpl.java:32)
    […]
[WARNING] Error injecting: org.reficio.p2.P2Mojo
com.google.inject.ProvisionException: Unable to provision, see the following errors:

1) Error injecting constructor, java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
  at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init>(Unknown Source)
  while locating org.eclipse.tycho.core.locking.FileLockServiceImpl
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.tycho.locking.facade.FileLockService
  while locating org.eclipse.tycho.core.osgitools.DefaultBundleReader
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.tycho.core.osgitools.BundleReader
  while locating org.eclipse.sisu.equinox.launching.internal.DefaultEquinoxInstallationFactory
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.sisu.equinox.launching.EquinoxInstallationFactory
  while locating org.eclipse.sisu.equinox.launching.internal.P2ApplicationLauncher
  while locating org.reficio.p2.P2Mojo

1 error
    at com.google.inject.internal.InternalProvisionException.toProvisionException (InternalProvisionException.java:226)
    at com.google.inject.internal.InjectorImpl$1.get (InjectorImpl.java:1053)
    at com.google.inject.internal.InjectorImpl.getInstance (InjectorImpl.java:1086)
    at org.eclipse.sisu.space.AbstractDeferredClass.get (AbstractDeferredClass.java:48)
    at com.google.inject.internal.ProviderInternalFactory.provision (ProviderInternalFactory.java:85)
    at com.google.inject.internal.InternalFactoryToInitializableAdapter.provision (InternalFactoryToInitializableAdapter.java:57)
    at com.google.inject.internal.ProviderInternalFactory$1.call (ProviderInternalFactory.java:66)
    at com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (ProvisionListenerStackCallback.java:112)
    at com.google.inject.internal.ProvisionListenerStackCallback$Provision.provision (ProvisionListenerStackCallback.java:127)
    at com.google.inject.internal.ProvisionListenerStackCallback.provision (ProvisionListenerStackCallback.java:66)
    at com.google.inject.internal.ProviderInternalFactory.circularGet (ProviderInternalFactory.java:61)
    at com.google.inject.internal.InternalFactoryToInitializableAdapter.get (InternalFactoryToInitializableAdapter.java:47)
    at com.google.inject.internal.InjectorImpl$1.get (InjectorImpl.java:1050)
    at org.eclipse.sisu.inject.Guice4$1.get (Guice4.java:162)
    at org.eclipse.sisu.inject.LazyBeanEntry.getValue (LazyBeanEntry.java:81)
    at org.eclipse.sisu.plexus.LazyPlexusBean.getValue (LazyPlexusBean.java:51)
    at org.codehaus.plexus.DefaultPlexusContainer.lookup (DefaultPlexusContainer.java:263)
    at org.codehaus.plexus.DefaultPlexusContainer.lookup (DefaultPlexusContainer.java:255)
    at org.apache.maven.plugin.internal.DefaultMavenPluginManager.getConfiguredMojo (DefaultMavenPluginManager.java:520)
    […]
Caused by: java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
    at java.lang.ClassLoader.checkPackageSigners (ClassLoader.java:575)
    at java.lang.ClassLoader.defineClassInternal (ClassLoader.java:468)
    at java.lang.ClassLoader.defineClass (ClassLoader.java:442)
    at java.security.SecureClassLoader.defineClass (SecureClassLoader.java:174)
    at java.net.URLClassLoader.defineClass (URLClassLoader.java:688)
    at java.net.URLClassLoader$ClassFinder.run (URLClassLoader.java:1093)
    at java.net.URLClassLoader$ClassFinder.run (URLClassLoader.java:1078)
    at java.security.AccessController.doPrivileged (AccessController.java:770)
    at java.net.URLClassLoader.findClass (URLClassLoader.java:603)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClassFromSelf (ClassRealm.java:425)
    at org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy.loadClass (SelfFirstStrategy.java:42)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.unsynchronizedLoadClass (ClassRealm.java:271)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass (ClassRealm.java:247)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass (ClassRealm.java:239)
    at org.eclipse.osgi.internal.log.EquinoxLogServices.<init> (EquinoxLogServices.java:94)
    at org.eclipse.osgi.internal.framework.EquinoxContainer.<init> (EquinoxContainer.java:90)
    at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init> (FileLockServiceImpl.java:32)
    […]
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  1.035 s
[INFO] Finished at: 2021-03-03T09:12:36+01:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT:site (default-cli) on project config: Execution default-cli of goal org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT:site failed: Unable to load the mojo 'site' (or one of its required components) from the plugin 'org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT': com.google.inject.ProvisionException: Unable to provision, see the following errors:
[ERROR]
[ERROR] 1) Error injecting constructor, java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
[ERROR]   at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init>(Unknown Source)
[ERROR]   while locating org.eclipse.tycho.core.locking.FileLockServiceImpl
[ERROR]   at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
[ERROR]   while locating org.eclipse.tycho.locking.facade.FileLockService
[ERROR]   while locating org.eclipse.tycho.core.osgitools.DefaultBundleReader
[ERROR]   at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
[ERROR]   while locating org.eclipse.tycho.core.osgitools.BundleReader
[ERROR]   while locating org.eclipse.sisu.equinox.launching.internal.DefaultEquinoxInstallationFactory
[ERROR]   at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
[ERROR]   while locating org.eclipse.sisu.equinox.launching.EquinoxInstallationFactory
[ERROR]   while locating org.eclipse.sisu.equinox.launching.internal.P2ApplicationLauncher
[ERROR]   while locating org.reficio.p2.P2Mojo
[ERROR]   at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
[ERROR]   while locating org.apache.maven.plugin.Mojo annotated with @com.google.inject.name.Named(value="org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT:site")
[ERROR]
[ERROR] 1 error
[ERROR]       role: org.apache.maven.plugin.Mojo
[ERROR]   roleHint: org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT:site
[ERROR] -> [Help 1]
org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT:site (default-cli) on project config: Execution default-cli of goal org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT:site failed: Unable to load the mojo 'site' (or one of its required components) from the plugin 'org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT'
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:215)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
    […]
Caused by: org.apache.maven.plugin.PluginExecutionException: Execution default-cli of goal org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT:site failed: Unable to load the mojo 'site' (or one of its required components) from the plugin 'org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT'
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:156)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
    […]
Caused by: org.apache.maven.plugin.PluginContainerException: Unable to load the mojo 'site' (or one of its required components) from the plugin 'org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT'
Caused by: org.codehaus.plexus.component.repository.exception.ComponentLookupException: com.google.inject.ProvisionException: Unable to provision, see the following errors:

1) Error injecting constructor, java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
  at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init>(Unknown Source)
  while locating org.eclipse.tycho.core.locking.FileLockServiceImpl
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.tycho.locking.facade.FileLockService
  while locating org.eclipse.tycho.core.osgitools.DefaultBundleReader
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.tycho.core.osgitools.BundleReader
  while locating org.eclipse.sisu.equinox.launching.internal.DefaultEquinoxInstallationFactory
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.sisu.equinox.launching.EquinoxInstallationFactory
  while locating org.eclipse.sisu.equinox.launching.internal.P2ApplicationLauncher
  while locating org.reficio.p2.P2Mojo
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.apache.maven.plugin.Mojo annotated with @com.google.inject.name.Named(value="org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT:site")

1 error
      role: org.apache.maven.plugin.Mojo
  roleHint: org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT:site
    at org.codehaus.plexus.DefaultPlexusContainer.lookup (DefaultPlexusContainer.java:267)
    at org.codehaus.plexus.DefaultPlexusContainer.lookup (DefaultPlexusContainer.java:255)
    at org.apache.maven.plugin.internal.DefaultMavenPluginManager.getConfiguredMojo (DefaultMavenPluginManager.java:520)
    […]
Caused by: com.google.inject.ProvisionException: Unable to provision, see the following errors:

1) Error injecting constructor, java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
  at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init>(Unknown Source)
  while locating org.eclipse.tycho.core.locking.FileLockServiceImpl
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.tycho.locking.facade.FileLockService
  while locating org.eclipse.tycho.core.osgitools.DefaultBundleReader
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.tycho.core.osgitools.BundleReader
  while locating org.eclipse.sisu.equinox.launching.internal.DefaultEquinoxInstallationFactory
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.eclipse.sisu.equinox.launching.EquinoxInstallationFactory
  while locating org.eclipse.sisu.equinox.launching.internal.P2ApplicationLauncher
  while locating org.reficio.p2.P2Mojo
  at ClassRealm[plugin>org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT, parent: jdk.internal.loader.ClassLoaders$AppClassLoader@bc0521b0] (via modules: org.eclipse.sisu.wire.WireModule -> org.eclipse.sisu.plexus.PlexusBindingModule)
  while locating org.apache.maven.plugin.Mojo annotated with @com.google.inject.name.Named(value="org.reficio:p2-maven-plugin:1.5.1-SNAPSHOT:site")

1 error
    at com.google.inject.internal.InternalProvisionException.toProvisionException (InternalProvisionException.java:226)
    at com.google.inject.internal.InjectorImpl$1.get (InjectorImpl.java:1053)
    at org.eclipse.sisu.inject.Guice4$1.get (Guice4.java:162)
    at org.eclipse.sisu.inject.LazyBeanEntry.getValue (LazyBeanEntry.java:81)
    at org.eclipse.sisu.plexus.LazyPlexusBean.getValue (LazyPlexusBean.java:51)
    at org.codehaus.plexus.DefaultPlexusContainer.lookup (DefaultPlexusContainer.java:263)
    at org.codehaus.plexus.DefaultPlexusContainer.lookup (DefaultPlexusContainer.java:255)
    […]
Caused by: java.lang.SecurityException: Signers of 'org.osgi.service.log.LogLevel' do not match signers of other classes in package
    at java.lang.ClassLoader.checkPackageSigners (ClassLoader.java:575)
    at java.lang.ClassLoader.defineClassInternal (ClassLoader.java:468)
    at java.lang.ClassLoader.defineClass (ClassLoader.java:442)
    at java.security.SecureClassLoader.defineClass (SecureClassLoader.java:174)
    at java.net.URLClassLoader.defineClass (URLClassLoader.java:688)
    at java.net.URLClassLoader$ClassFinder.run (URLClassLoader.java:1093)
    at java.net.URLClassLoader$ClassFinder.run (URLClassLoader.java:1078)
    at java.security.AccessController.doPrivileged (AccessController.java:770)
    at java.net.URLClassLoader.findClass (URLClassLoader.java:603)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClassFromSelf (ClassRealm.java:425)
    at org.codehaus.plexus.classworlds.strategy.SelfFirstStrategy.loadClass (SelfFirstStrategy.java:42)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.unsynchronizedLoadClass (ClassRealm.java:271)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass (ClassRealm.java:247)
    at org.codehaus.plexus.classworlds.realm.ClassRealm.loadClass (ClassRealm.java:239)
    at org.eclipse.osgi.internal.log.EquinoxLogServices.<init> (EquinoxLogServices.java:94)
    at org.eclipse.osgi.internal.framework.EquinoxContainer.<init> (EquinoxContainer.java:90)
    at org.eclipse.tycho.core.locking.FileLockServiceImpl.<init> (FileLockServiceImpl.java:32)
    […]

OK, wow. This is already the shortened output from an integration test.

Now, the org.osgi.service.log.LogLevel is contained in one of Tycho’s dependencies:

<dependency>
                <groupId>org.eclipse.platform</groupId>
                <artifactId>org.eclipse.osgi</artifactId>
                <version>3.15.200</version>
            </dependency>

So huh, what is going on here? Answer: Tycho was not compiled against the dependency it declares. Instead, if you add this dependency in front of the eclipse osgi dependency, it will work:

<dependency>
            <groupId>org.osgi</groupId>
            <artifactId>org.osgi.service.log</artifactId>
            <version>1.4.0</version>
        </dependency>

We were puzzled how this was possible. We are grateful for any explanations (and why there are overlapping classes!).

Contact us on twitter

Sandra:

https://twitter.com/SandraParsick

Ben (me):

https://twitter.com/bmarwell