Issue: jarsigner Unable to Sign Apache Iceberg JARs

[avineshsachan]

Apache Iceberg version

1.11.0 (latest release)

Query engine

Flink

Please describe the bug 🐞

The Java jarsigner tool is failing to sign the following Apache Iceberg JAR files:

iceberg-aws-bundle 1.11.0 :https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-aws-bundle/1.11.0

iceberg-flink-runtime-2.1 1.11.0 : https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-flink-runtime-2.1/1.11.0

Error encountered during signing:

java.util.zip.ZipException: duplicate entry: LICENSE
Description:

When attempting to sign the above JARs using jarsigner, the process fails with a ZipException indicating a duplicate entry for LICENSE within the JAR archive. This is likely caused by the JAR being an uber/fat JAR (a bundled JAR that merges multiple dependencies), which may contain duplicate LICENSE files from different bundled libraries, making it non-compliant with the ZIP specification and incompatible with the jarsigner tool.

Willingness to contribute

• I can contribute a fix for this bug independently
• I would be willing to contribute a fix for this bug with guidance from the Iceberg community
• I cannot contribute a fix for this bug at this time

[RussellSpitzer]

Is this a problem for us? We sign our releases with GPG?

[avineshsachan]

It does not seem related to GPG signing, below issue comes while signing these jars with standard java jarsigner tool utility:

java.util.zip.ZipException: duplicate entry: LICENSE & Notice file in both ot these jars

Steps to reproduce issue:

1. download these jars

https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-aws-bundle/1.11.0

https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-flink-runtime-2.1/1.11.0

2. try to sign jar using java jarsigner utility
   2.1 generate keystore
   keytool -genkeypair -alias mykey -keyalg RSA -keysize 2048 -validity 365 -keystore my-keystore.jks -storepass changeit -keypass changeit -dname "CN=Test User, OU=Dev, O=MyOrg, L=City, ST=State, C=US"
   2.2 sign using keystore, then error shall be shown
   jarsigner -keystore my-keystore.jks -storepass changeit -keypass changeit iceberg-flink-runtime-2.1-1.11.0.jar mykey

jarsigner: unable to sign jar: java.util.zip.ZipException: duplicate entry: LICENSE

root cause is duplicate LICENSE and NOTICE files inside these jars :

jar -tf iceberg-flink-runtime-2.0-1.10.1.jar| grep -i License

LICENSE
META-INF/LICENSE
META-INF/licenses/
META-INF/licenses/org.projectnessie.nessie/
META-INF/licenses/org.projectnessie.nessie/nessie-client-0.104.5/
META-INF/licenses/org.projectnessie.nessie/nessie-client-0.104.5/LICENSE
META-INF/licenses/org.projectnessie.nessie/nessie-client-0.104.5/NOTICE
META-INF/licenses/org.projectnessie.nessie/nessie-model-0.104.5/
META-INF/licenses/org.projectnessie.nessie/nessie-model-0.104.5/LICENSE
META-INF/licenses/org.projectnessie.nessie/nessie-model-0.104.5/NOTICE
META-INF/FastDoubleParser-LICENSE
META-INF/thirdparty-LICENSE
META-INF/LICENSE.txt
org/eclipse/microprofile/openapi/annotations/info/License.class
org/eclipse/microprofile/openapi/models/info/License.class
LICENSE

jar -tf iceberg-flink-runtime-2.0-1.10.1.jar| grep -i Notice
NOTICE
META-INF/NOTICE
META-INF/licenses/org.projectnessie.nessie/nessie-client-0.104.5/NOTICE
META-INF/licenses/org.projectnessie.nessie/nessie-model-0.104.5/NOTICE
META-INF/FastDoubleParser-NOTICE
NOTICE

Expectation : duplicate LICENSE and NOTICE files should not be present in below jars so that stadard Java jarsigner utility can sign these jars :

https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-aws-bundle/1.11.0

https://mvnrepository.com/artifact/org.apache.iceberg/iceberg-flink-runtime-2.1/1.11.0