Compilation error while building

[Simon Kissane]

I cloned the Git repo and tried building the latest master branch using "mvn package"

It fails with a compilation error in HSMTest.java:

[INFO] -------------------------------------------------------------
[INFO] -------------------------------------------------------------
[ERROR] COMPILATION ERROR : 
[INFO] -------------------------------------------------------------
[ERROR] /Users/skissane/repos/nimbus-jose-jwt/src/test/java/com/nimbusds/jose/crypto/HSMTest.java:[84,43] error: incompatible types: InputStream cannot be converted to Config
[INFO] 1 error
[INFO] -------------------------------------------------------------
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  10.625 s
[INFO] Finished at: 2020-07-22T13:59:23+10:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.5.1:testCompile (default-testCompile) on project nimbus-jose-jwt: Compilation failure
[ERROR] /Users/skissane/repos/nimbus-jose-jwt/src/test/java/com/nimbusds/jose/crypto/HSMTest.java:[84,43] error: incompatible types: InputStream cannot be converted to Config

I tried it with both JDK 8 (AdoptOpenJDK build 1.8.0_232-b09 for 64-bit macOS) and JDK 11 (AdoptOpenJDK build 11.0.4+11 for 64-bit macOS) and I get the same compilation failure for both.

[Yavor Vasilev]

Hi Simon,

The HSM tests were designed for testing JOSE with hardware security modules with Java 8 on Linux. My suggestion is to comment them out to build the project on MacOS.

[Simon Kissane]

Hi Yavor

The problem is not specific to macOS. It also occurs on Linux when using AdoptOpenJDK 11.0.5+10 (but not when using AdoptOpenJDK 1.8.0_252 on Linux).

It appears that the API of the undocumented sun.security.pkcs11.SunPKCS11 class has changed in newer Java versions, in a backward incompatible way. For some reason, the new API is present in OpenJDK 8 on macOS, but the old API is still there in OpenJDK 8 on Linux. By contrast, in OpenJDK 11, the new API is present on both macOS and Linux.

In the old API, SunPKCS11 class has a public constructor which takes an InputStream from which it reads the config file.
In the new API, the InputStream constructor is gone. The only public constructor is no-args.
But now there is a new method configure() which takes a String.
If the String starts with "--", it is the config file contents. Otherwise, the string is the path to the file to read the config file from.

The only way to be compatible with both versions is to use reflection to invoke the API.

I attach a patch which does that. I have tested it, the HSMTest compiles fine on both OpenJDK 8&11 on both macOS and Linux.

[Simon Kissane]

Reopening because not macOS-specific, and I have a patch to fix it. (I'd open a PR for the patch but I don't appear to have permission to do that.)

[Vladimir Dzhuvinov]

Thank you Simon, I merged your patch and tested in on Linux with Java 8 and 11, with and without an HSM (Nitrokey).

Commit: 86a2609

[Vladimir Dzhuvinov]

Why they changed the PKCS#11 API like that and it doesn’t seem to make things better, more functional or easier, is beyond me.