Skip to content

openjdk17 is having trouble with SSL #370

Closed
Closed
openjdk17 is having trouble with SSL#370
Assignees
jperkin

Description

@vkz
vkz
opened on Nov 23, 2023

Affected images:

  • base-64-lts
  • base-64-trunk

Likely culprit

openjdk17 but opnejdk11 appears to work just fine

Gist of it:

when Java attempts to transfer artifacts from https://repo1.maven.org/maven2/ getting this error
javax.net.ssl.SSLException: Received fatal alert: bad_record_mac

Full Stacktrace 
Error building classpath. Failed to read artifact descriptor for org.clojure:clojure:jar:1.11.1
org.eclipse.aether.resolution.ArtifactDescriptorException: Failed to read artifact descriptor for org.clojure:clojure:jar:1.11.1
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:255)
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.readArtifactDescriptor(DefaultArtifactDescriptorReader.java:171)
        at org.eclipse.aether.internal.impl.DefaultRepositorySystem.readArtifactDescriptor(DefaultRepositorySystem.java:263)
        at clojure.tools.deps.alpha.extensions.maven$read_descriptor.invokeStatic(maven.clj:115)
        at clojure.tools.deps.alpha.extensions.maven$fn__1137.invokeStatic(maven.clj:143)
        at clojure.tools.deps.alpha.extensions.maven$fn__1137.invoke(maven.clj:143)
        at clojure.lang.MultiFn.invoke(MultiFn.java:244)
        at clojure.tools.deps.alpha$expand_deps$children_task__773$fn__775$fn__776.invoke(alpha.clj:405)
        at clojure.tools.deps.alpha.util.concurrent$submit_task$task__481.invoke(concurrent.clj:35)
        at clojure.lang.AFn.call(AFn.java:18)
        at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: org.eclipse.aether.resolution.ArtifactResolutionException: Could not transfer artifact org.clojure:clojure:pom:1.11.1 from/to central (https://repo1.maven.org/maven2/): Received fatal alert: bad_record_mac
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:431)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts(DefaultArtifactResolver.java:235)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifact(DefaultArtifactResolver.java:212)
        at org.apache.maven.repository.internal.DefaultArtifactDescriptorReader.loadPom(DefaultArtifactDescriptorReader.java:240)
        ... 13 more
Caused by: org.eclipse.aether.transfer.ArtifactTransferException: Could not transfer artifact org.clojure:clojure:pom:1.11.1 from/to central (https://repo1.maven.org/maven2/): Received fatal alert: bad_record_mac
        at org.eclipse.aether.connector.basic.ArtifactTransportListener.transferFailed(ArtifactTransportListener.java:52)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:401)
        at org.eclipse.aether.util.concurrency.RunnableErrorForwarder.lambda$wrap$0(RunnableErrorForwarder.java:73)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$DirectExecutor.execute(BasicRepositoryConnector.java:669)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector.get(BasicRepositoryConnector.java:290)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.performDownloads(DefaultArtifactResolver.java:520)
        at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve(DefaultArtifactResolver.java:408)
        ... 16 more
Caused by: javax.net.ssl.SSLException: Received fatal alert: bad_record_mac
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:133)
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:358)
        at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293)
        at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:204)
        at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1505)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1420)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
        at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436)
        at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)
        at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
        at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)
        at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)
        at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
        at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
        at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
        at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
        at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:72)
        at org.eclipse.aether.transport.http.HttpTransporter.execute(HttpTransporter.java:359)
        at org.eclipse.aether.transport.http.HttpTransporter.implGet(HttpTransporter.java:294)
        at org.eclipse.aether.spi.connector.transport.AbstractTransporter.get(AbstractTransporter.java:72)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$GetTaskRunner.runTask(BasicRepositoryConnector.java:496)
        at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run(BasicRepositoryConnector.java:396)
        ... 21 more

Detailed steps

pkgin up
pkgin upgrade
pkgin in clojure
# ^^ depends on openjdk17
# try it
clojure
# or start a repl
clj

and you get the above stacktrace.

What happens? Clojure attempts to build classpath and pull packages it needs from Maven Central. Looks to me like Java blows up during SSL handshake or exchange or establishing a protocol.

Just to be sure I confirmed that Maven responds with TLSv1.2:

curl -vvvv -k https://repo1.maven.org/maven2/  |  head

Tried forcing Java's hand with esoteric nonsense like:

JAVA_OPTS="-Dhttps.protocols=TLSv1.2 -Djavax.net.debug=all -Djdk.tls.client.protocols=TLSv1.2" && clojure

which had no effect whatsoever, so I'm thinking problem is fundamental to openjdk17 build.

openjdk11 works or how to fix clojure package

$ which clojure
/opt/local/bin/clojure

is just a bash script that hardcodes on L181

JAVA_CMD=${JAVA_CMD:-$(type -p /opt/local/java/openjdk17/bin/java)}

which we can change by hand

JAVA_CMD=${JAVA_CMD:-$(type -p /opt/local/java/openjdk11/bin/java)}

now pkgin in openjdk11 and clojure works.

What are the chances of this being fixed?

I'm new here and don't know how active people are fixing and contributing. What are the chances that openjdk17 gets fixed and subsequent versions become available in packages?

Thank you

Activity

  1. jperkin
    added a commit that references this issue on Feb 23, 2024

    devel/git-cliff: update to 2.0.2

    94f8ddc
  2. jperkin
    added a commit that references this issue on Mar 4, 2024

    audio/spotify-player: update to 0.17.0

    0239294
  3. jperkin
    added a commit that references this issue on Aug 2, 2024

    devel/git-branchless: update to 0.9.0

    e18f84e
  4. jperkin
    added a commit that references this issue on Aug 24, 2024

    py-terminator: update to 2.1.4.

    e93ce33
  5. github-actions
    added 2 commits that reference this issue on Oct 13, 2024

    www/xh: update to 0.23.0

    8fd223b

    net/slumber: update to 2.1.0

    d2581c4
  6. github-actions
    added a commit that references this issue on Nov 3, 2024

    (lang/R-cpp11) Updated 0.4.7 to 0.5.0

    cd79638
  7. github-actions
    added a commit that references this issue on Dec 15, 2024

    (textproc/R-htmltools) Updated 0.5.4 to 0.5.8.1

    950671a
  8. github-actions
    added a commit that references this issue on Jan 2, 2025

    net/ruby-net-imap: update to 0.5.4

    616ad60
  9. github-actions
    added a commit that references this issue on Feb 6, 2025

    textproc/inlyne: update to 0.5.0

    d75e821
  10. github-actions
    added a commit that references this issue on May 17, 2025

    devel/ruby-iruby: update to 0.8.2

    892b11d
  11. jperkin
    self-assigned this
    on Jun 30, 2025

  12. jperkin commented on Jun 30, 2025

    @jperkin
    jperkin
    on Jun 30, 2025
    Collaborator

    Hi, sorry it took me so long to get back to this, it's likely this was fixed in updates to the openjdk packages I've made since then as it appears to work fine for me in the latest trunk:

    $ clojure 
Downloading: org/clojure/clojure/1.12.0/clojure-1.12.0.pom from central
Downloading: org/clojure/spec.alpha/0.5.238/spec.alpha-0.5.238.pom from central
Downloading: org/clojure/core.specs.alpha/0.4.74/core.specs.alpha-0.4.74.pom from central
Downloading: org/clojure/pom.contrib/1.2.0/pom.contrib-1.2.0.pom from central
Downloading: org/clojure/core.specs.alpha/0.4.74/core.specs.alpha-0.4.74.jar from central
Downloading: org/clojure/clojure/1.12.0/clojure-1.12.0.jar from central
Downloading: org/clojure/spec.alpha/0.5.238/spec.alpha-0.5.238.jar from central
Clojure 1.12.0
user=> ^D
$ pkg_info | grep openjdk
openjdk17-17.0.13   Open-source implementation of the Java Platform, Standard Edition

    Please open another ticket if it's still not working the way you expect.

    Cheers.

  13. jperkin
    closed this as completedon Jun 30, 2025
  14. alexxlabs
    added a commit that references this issue on Jul 29, 2025

    nghttp3: update to 1.11.0.

    757d42e

  15. 14 remaining items

  16. jperkin
    added 12 commits that reference this issue on May 14, 2026

    www/xh: update to 0.23.0

    8e9d162

    net/slumber: update to 2.1.0

    0694140

    (lang/R-cpp11) Updated 0.4.7 to 0.5.0

    f4455f7

    (textproc/R-htmltools) Updated 0.5.4 to 0.5.8.1

    631dd3a

    net/ruby-net-imap: update to 0.5.4

    60e5c4c

    textproc/inlyne: update to 0.5.0

    ceee304

    Update converters/unoconv to 0.8.2

    5551288

    devel/ruby-iruby: update to 0.8.2

    ba534ed

    nghttp3: update to 1.11.0.

    e4a34d6

    jjui: update to 0.9.6.

    d8bb349

    devel/ruby-cucumber-expressions: update to 19.0.0

    0c63665

    py-mistune: update to 3.2.1.

    439eb20
  17. jperkin
    added a commit that references this issue on May 22, 2026

    py-mistune: update to 3.2.1.

    48c9f8a
  18. github-actions
    added a commit that references this issue on Jun 1, 2026

    p5-Template-Toolkit: update to 3.106.

    697588a
  19. github-actions
    added a commit that references this issue on Jun 15, 2026

    (geography/R-osmdata) Updated 0.2.5 to 0.3.0, fix build against R 4.6.0

    797157c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions