Skip to content

AppCDS usage causing sealing violations #9608

Description

@jcharaoui

I've been working on updating the JRuby package in Debian from 9.4.14.0 to 10.1.1.0 and have (again) come across an issue that causing headaches in several tests. The problem at hand was previously discussed in #9255 (comment) and so I'm creating an issue to track it here.

The latest manifestation of the problem occurs in these two test failures:

  1) Failure:
TestExtLibs#test_existence_of_digest/sha1 [/tmp/autopkgtest-virt-docker.shared.5f9la6am/downtmp/autopkgtest_tmp/test/mri/test_extlibs.rb:20]:
extension library `digest/sha1' is not found
/usr/share/jruby/lib/ruby/stdlib/ext/digest/sha1/mkmf.log not found.
Exception raised:
<#<NameError: cannot load (ext) (org.jruby.ext.digest.SHA1)>>
Backtrace:
  org/jruby/ext/jruby/JRubyUtilLibrary.java:229:in 'load_ext'
  /usr/share/jruby/lib/ruby/stdlib/digest/sha1.rb:3:in '<main>'
  org/jruby/RubyKernel.java:1384:in 'require'
  -:13:in 'block in <main>'.

  2) Failure:
TestExtLibs#test_existence_of_digest/bubblebabble [/tmp/autopkgtest-virt-docker.shared.5f9la6am/downtmp/autopkgtest_tmp/test/mri/test_extlibs.rb:20]:
extension library `digest/bubblebabble' is not found
/usr/share/jruby/lib/ruby/stdlib/ext/digest/bubblebabble/mkmf.log not found.
Exception raised:
<#<NameError: cannot load (ext) (org.jruby.ext.digest.BubbleBabble)>>
Backtrace:
  org/jruby/ext/jruby/JRubyUtilLibrary.java:229:in 'load_ext'
  /usr/share/jruby/lib/ruby/stdlib/digest/bubblebabble.rb:3:in '<main>'
  org/jruby/RubyKernel.java:1384:in 'require'
  -:13:in 'block in <main>'.

When running the test/mri/test_extlibs.rb tests with JRUBY_OPTS=--nocache the problem doesn't occur, which suggests AppCDS is involved.

I was able to reproduce this error outside the test suite like so:

root@36493d2e0d0a:/pkg# rm /root/.cache/*.jsa
root@36493d2e0d0a:/pkg# jruby -v -e "require 'digest/sha1'"
jruby 10.1.1.0 (4.0.0) 2026-08-25 10.1.1.0+d OpenJDK 64-Bit Server VM 25.0.4.1+1-1-Debian on 25.0.4.1+1-1-Debian +indy +jit [x86_64-linux]
root@36493d2e0d0a:/pkg# jruby -v -e "require 'digest/md5'"
jruby 10.1.1.0 (4.0.0) 2026-08-25 10.1.1.0+d OpenJDK 64-Bit Server VM 25.0.4.1+1-1-Debian on 25.0.4.1+1-1-Debian +indy +jit [x86_64-linux]
2026-08-27T11:21:01.820Z [main] ERROR Ruby :
java.lang.SecurityException: sealing violation: package org.jruby.ext.digest is sealed
        at java.base/jdk.internal.loader.BuiltinClassLoader.getAndVerifyPackage(BuiltinClassLoader.java:820)
        at java.base/jdk.internal.loader.BuiltinClassLoader.defineOrCheckPackage(BuiltinClassLoader.java:791)
        at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.defineOrCheckPackage(ClassLoaders.java:185)
        at java.base/java.lang.ClassLoader.findLoadedClass0(Native Method)
        at java.base/java.lang.ClassLoader.findLoadedClass(ClassLoader.java:1234)
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClassOrNull(BuiltinClassLoader.java:592)
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:578)
        at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:490)
        at org.jruby.dist/org.jruby.ext.digest.MD5.load(MD5.java:40)
        at org.jruby.dist/org.jruby.ext.jruby.JRubyUtilLibrary.loadExtension(JRubyUtilLibrary.java:253)
        at org.jruby.dist/org.jruby.ext.jruby.JRubyUtilLibrary.load_ext(JRubyUtilLibrary.java:229)
        at org.jruby.dist/org.jruby.ext.jruby.JRubyUtilLibrary$INVOKER$s$1$0$load_ext.call(JRubyUtilLibrary$INVOKER$s$1$0$load_ext.gen)
        at org.jruby.dist/org.jruby.runtime.callsite.CachingCallSite.cacheAndCall(CachingCallSite.java:452)
        at org.jruby.dist/org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:242)
        at org.jruby.dist/org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:320)
        at org.jruby.dist/org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)
        at org.jruby.dist/org.jruby.ir.interpreter.Interpreter.INTERPRET_ROOT(Interpreter.java:100)
        at org.jruby.dist/org.jruby.ir.interpreter.Interpreter.execute(Interpreter.java:85)
        at org.jruby.dist/org.jruby.ir.interpreter.Interpreter.execute(Interpreter.java:35)
        at org.jruby.dist/org.jruby.ir.IRTranslator.execute(IRTranslator.java:42)
        at org.jruby.dist/org.jruby.Ruby.runInterpreter(Ruby.java:1240)
        at org.jruby.dist/org.jruby.Ruby.loadFile(Ruby.java:3023)
        at org.jruby.dist/org.jruby.runtime.load.LibrarySearcher$ResourceLibrary.load(LibrarySearcher.java:945)
        at org.jruby.dist/org.jruby.runtime.load.LibrarySearcher$FoundLibrary.load(LibrarySearcher.java:903)
        at org.jruby.dist/org.jruby.runtime.load.LoadService.tryLoadingLibraryOrScript(LoadService.java:669)
        at org.jruby.dist/org.jruby.runtime.load.LoadService.lambda$smartLoadInternal$0(LoadService.java:571)
        at org.jruby.dist/org.jruby.runtime.load.LoadService$RequireLocks.executeAndClearLock(LoadService.java:510)
        at org.jruby.dist/org.jruby.runtime.load.LoadService$RequireLocks.lock(LoadService.java:470)
        at org.jruby.dist/org.jruby.runtime.load.LoadService.smartLoadInternal(LoadService.java:557)
        at org.jruby.dist/org.jruby.runtime.load.LoadService.require(LoadService.java:408)
        at org.jruby.dist/org.jruby.RubyKernel.requireCommon(RubyKernel.java:1389)
        at org.jruby.dist/org.jruby.RubyKernel.require(RubyKernel.java:1384)
        at org.jruby.dist/org.jruby.RubyKernel$INVOKER$s$1$0$require.call(RubyKernel$INVOKER$s$1$0$require.gen)
        at org.jruby.dist/org.jruby.internal.runtime.methods.JavaMethod$JavaMethodOneOrNBlock.call(JavaMethod.java:384)
        at org.jruby.dist/org.jruby.internal.runtime.methods.AliasMethod.call(AliasMethod.java:106)
        at org.jruby.dist/org.jruby.runtime.callsite.CachingCallSite.call(CachingCallSite.java:240)
        at org.jruby.dist/org.jruby.ir.interpreter.InterpreterEngine.processCall(InterpreterEngine.java:320)
        at org.jruby.dist/org.jruby.ir.interpreter.StartupInterpreterEngine.interpret(StartupInterpreterEngine.java:66)
        at org.jruby.dist/org.jruby.internal.runtime.methods.MixedModeIRMethod.INTERPRET_METHOD(MixedModeIRMethod.java:133)
        at org.jruby.dist/org.jruby.internal.runtime.methods.MixedModeIRMethod.call(MixedModeIRMethod.java:120)
        at org.jruby.dist/org.jruby.ir.targets.indy.InvokeSite.performIndirectCall(InvokeSite.java:893)
        at org.jruby.dist/org.jruby.ir.targets.indy.InvokeSite.invoke(InvokeSite.java:820)
        at DashE.???script(-e:1)
        at DashE.run(-e)
        at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:735)
        at org.jruby.dist/org.jruby.ir.Compiler$1.load(Compiler.java:114)
        at org.jruby.dist/org.jruby.Ruby.runScript(Ruby.java:1227)
        at org.jruby.dist/org.jruby.Ruby.runNormally(Ruby.java:1139)
        at org.jruby.dist/org.jruby.Ruby.runFromMain(Ruby.java:984)
        at org.jruby.dist/org.jruby.main.Main.internalRun(Main.java:289)
        at org.jruby.dist/org.jruby.main.Main.run(Main.java:239)
        at org.jruby.dist/org.jruby.main.Main.main(Main.java:211)
        at org.jruby.dist/org.jruby.Main.main(Main.java:85)
NameError: cannot load (ext) (org.jruby.ext.digest.MD5)
  load_ext at org/jruby/ext/jruby/JRubyUtilLibrary.java:229
    <main> at /usr/share/jruby/lib/ruby/stdlib/digest/md5.rb:3
   require at org/jruby/RubyKernel.java:1384
   require at /usr/share/jruby/lib/ruby/stdlib/rubygems/core_ext/kernel_require.rb:139
    <main> at -e:1

I wasn't able to reproduce this with a regular build from Git, so it's possible that the Debian packaging itself is surfacing some uncommon underlying error condition.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions