I'm building a native image with quarkus and the graal analysis fails with the error:
Error: No instances of sun.security.provider.NativePRNG are allowed in the image heap as this class should be initialized at image runtime. Object has been initialized without the native-image initialization instrumentation and the stack trace can't be tracked.
Detailed message:
Trace: Object was reached by
reading field java.security.SecureRandom.secureRandomSpi of
constant java.security.SecureRandom@472a6481 reached by
scanning method com.nimbusds.oauth2.sdk.id.Identifier.<init>(Identifier.java:112)
Call path from entry point to com.nimbusds.oauth2.sdk.id.Identifier.<init>(int):
at com.nimbusds.oauth2.sdk.id.Identifier.<init>(Identifier.java:105)
at com.nimbusds.oauth2.sdk.token.Token.<init>(Token.java:62)
at com.nimbusds.oauth2.sdk.token.AccessToken.<init>(AccessToken.java:121)
at com.nimbusds.oauth2.sdk.token.BearerAccessToken.<init>(BearerAccessToken.java:114)
at ff.service.identity.application.OAuthAccessTokenProvider.generateAccessToken(OAuthAccessTokenProvider.java:78)
at ff.service.identity.application.OAuthAccessTokenProvider.completeAccessTokenGeneration(OAuthAccessTokenProvider.java:62)
at ff.service.identity.application.OAuthAccessTokenProvider_ClientProxy.completeAccessTokenGeneration(OAuthAccessTokenProvider_ClientProxy.zig:198)
at ff.service.identity.application.OAuthService.validateSignedChallenge(OAuthService.java:187)
at ff.service.identity.application.OAuthService_Subclass.validateSignedChallenge$$superaccessor1(OAuthService_Subclass.zig:258)
at ff.service.identity.application.OAuthService_Subclass$$function$$1.apply(OAuthService_Subclass$$function$$1.zig:41)
at sun.security.ec.XECParameters$1.get(XECParameters.java:183)
at com.oracle.svm.core.jdk.SystemPropertiesSupport.initializeLazyValue(SystemPropertiesSupport.java:190)
at com.oracle.svm.core.jdk.SystemPropertiesSupport.getProperty(SystemPropertiesSupport.java:143)
at com.oracle.svm.core.jdk.Target_java_lang_System.getProperty(JavaLangSubstitutions.java:345)
at com.oracle.svm.jni.JNIJavaCallWrappers.jniInvoke_ARRAY:Ljava_lang_System_2_0002egetProperty_00028Ljava_lang_String_2_00029Ljava_lang_String_2(generated:0)
It correctly and logically states that the class for the random number generator provider should be initialised at runtime. However, unlike in the docs, no call path is given because the:
Object has been initialized without the native-image initialization instrumentation and the stack trace can't be tracked
I don't know how to go about restructuring my code to support this, and I'm not doing anything really exotic, as far as I can tell. To prepare this question, I brutally moved the code together involving classes from com.nimbusds, and it now resides in OAuthService and OAuthAccessTokenProvider. OAuthService is only used by my OAuthResouce, and even after making these two services @RequestScoped to enforce lazy initialization, the error message remains unchanged.
When I add --initialize-at-run-time=ff.service.identity.application.OAuthService, I actually receive less information about the observed problem.
Error: Classes that should be initialized at run time got initialized during image building:
ff.service.identity.application.OAuthService the class was requested to be initialized at run time (from the command line). ff.service.identity.application.OAuthService has been initialized without the native-image initialization instrumentation and the stack trace can't be tracked. Try avoiding to initialize the class that caused initialization of ff.service.identity.application.OAuthService
com.oracle.svm.core.util.UserError$UserException: Classes that should be initialized at run time got initialized during image building:
ff.service.identity.application.OAuthService the class was requested to be initialized at run time (from the command line). ff.service.identity.application.OAuthService has been initialized without the native-image initialization instrumentation and the stack trace can't be tracked. Try avoiding to initialize the class that caused initialization of ff.service.identity.application.OAuthService
at com.oracle.svm.core.util.UserError.abort(UserError.java:68)
at com.oracle.svm.hosted.classinitialization.ConfigurableClassInitialization.checkDelayedInitialization(ConfigurableClassInitialization.java:518)
at com.oracle.svm.hosted.classinitialization.ClassInitializationFeature.duringAnalysis(ClassInitializationFeature.java:187)
at com.oracle.svm.hosted.NativeImageGenerator.lambda$runPointsToAnalysis$8(NativeImageGenerator.java:720)
at com.oracle.svm.hosted.FeatureHandler.forEachFeature(FeatureHandler.java:70)
at com.oracle.svm.hosted.NativeImageGenerator.runPointsToAnalysis(NativeImageGenerator.java:720)
at com.oracle.svm.hosted.NativeImageGenerator.doRun(NativeImageGenerator.java:538)
at com.oracle.svm.hosted.NativeImageGenerator.lambda$run$0(NativeImageGenerator.java:451)
at java.base/java.util.concurrent.ForkJoinTask$AdaptedRunnableAction.exec(ForkJoinTask.java:1407)
at java.base/java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:290)
at java.base/java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1020)
at java.base/java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1656)
at java.base/java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1594)
at java.base/java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:177)
I'm supposted to avoid initializing these classes, but I don't know what I'm doing wrong or what other possibilities exist. What have I overseen?
EDIT: I am building with Quarkus 1.6.1.Final, using GraalVM Version 20.1.0 (Java Version 11.0.7).
A solution involving the flag --rerun-class-initialization-at-runtime is actually deprecated since GraalVM 19.0.0 (I can't find a link):
Warning: Using a deprecated option --rerun-class-initialization-at-runtime. Currently there is no replacement for this option. Try using --initialize-at-run-time or use the non-API option -H:ClassInitialization directly.
