[MNG-8471] library load disallowed by system policy on Mac

[jira-importer]

Elliotte Rusty Harold opened MNG-8471 and commented

On a Mac with Sequoia 15.1.1 running the binary 4.0-RC2 release to "mvn clean verify" the maven-compiler-plugin

WARNING: Failed to load native library:libjlinenative.jnilib. osinfo: Mac/arm64 (caused by: java.lang.UnsatisfiedLinkError: /opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib: dlopen(/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib, 0x0001): tried: '/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib' (code signature in <E83722FF-713D-3654-A603-EEBC715887FE> '/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib' not valid for use in process: library load disallowed by system policy), '/System/Volumes/Preboot/Cryptexes/OS/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib' (no such file), '/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib' (code signature in <E83722FF-713D-3654-A603-EEBC715887FE> '/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib' not valid for use in process: library load disallowed by system policy), enable debug logging for stacktrace)

The build still seems to complete normally.

openjdk version "17.0.12" 2024-07-16
OpenJDK Runtime Environment Homebrew (build 17.0.12+0)
OpenJDK 64-Bit Server VM Homebrew (build 17.0.12+0, mixed mode, sharing)

Further, this isn't just a warning on the console. The mac actually pops up two alert dialogs to warn about this problem that user must click away during the build.

---

Affects: 4.0.0-rc-2

Attachments:

• Screenshot 2024-12-25 at 6.10.01 PM.png (1.17 MB)

0 votes, 8 watchers

[jira-importer]

Tamas Cservenak commented

may be dupe of MNG-7172, or at least related: most probably the "quarantine" feature of macOS, user needs to manually remove that attribute

[jira-importer]

Elliotte Rusty Harold commented

That one looks fixed. Let me look into this in more detail. But we shouldn't be shipping or depending on unsigned binaries.

[jira-importer]

Elliotte Rusty Harold commented

Also happens with mvn clean:

/opt/java/apache-maven-4.0.0-rc-2/bin/mvn clean
Dec 28, 2024 3:45:21 PM org.jline.nativ.JLineNativeLoader log
WARNING: Failed to load native library:libjlinenative.jnilib. osinfo: Mac/arm64 (caused by: java.lang.UnsatisfiedLinkError: /opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib: dlopen(/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib, 0x0001): tried: '/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib' (code signature in <E83722FF-713D-3654-A603-EEBC715887FE> '/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib' not valid for use in process: library load disallowed by system policy), '/System/Volumes/Preboot/Cryptexes/OS/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib' (no such file), '/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib' (code signature in <E83722FF-713D-3654-A603-EEBC715887FE> '/opt/java/apache-maven-4.0.0-rc-2/lib/jline-native/Mac/arm64/libjlinenative.jnilib' not valid for use in process: library load disallowed by system policy), enable debug logging for stacktrace)
[WARNING] Unable to find the root directory. Create a .mvn directory in the root directory or add the root="true" attribute on the root project's model to identify it.

[jira-importer]

Tamas Cservenak commented

Signing of binaries is mentioned on issue i pointed at. Is hardly doable.

Did you un-quarantine the files of Maven distro?

[jira-importer]

Elliotte Rusty Harold commented

Once again I'm looking at symptoms. I don't fully see the root cause here, but the current status simply doesn't work to an acceptable level. We don't want to add an extra unquarantine step for users. I think (though not certain) we're using a native library somewhere and we need to stop doing that.

[jira-importer]

Guillaume Nodet commented

We can require JDK 22 which would remove the need for that native library, since JDK 22 provides FFM which is supported by JLine.

[jira-importer]

Elliotte Rusty Harold commented

If JLine is the problem, can we remove the dependency on JLine? How critical is it? If all we're using it for is pretty colored lines, maybe we should simply stop coloring lines.

[jira-importer]

Guillaume Nodet commented

We've been using native libraries since years.
In Maven 3, we are loading jansi.

[jira-importer]

Elliotte Rusty Harold commented

Yes we have been suing native libraries for years, and this bug still seems to be new in Maven 4.0 so let's not ship with it. If there's a way to fix this and keep using the native libraries, great. Otherwise we need to reconsider native libraries.

[jira-importer]

Slawomir Jaranowski commented

I don't see such warning ..

% mvn -V help:system                                  
Apache Maven 4.0.0-rc-2 (273314404f85ec3c089e295d8b4e0cb18c287cf5)
Maven home: /Users/slawomir.jaranowski/.sdkman/candidates/maven/4.0.0-rc-2
Java version: 23.0.1, vendor: Eclipse Adoptium, runtime: /Users/slawomir.jaranowski/.sdkman/candidates/java/23.0.1-tem
Default locale: en_PL, platform encoding: UTF-8
OS name: "mac os x", version: "15.2", arch: "aarch64", family: "mac" 

 

[jira-importer]

Michael Osipov commented

gnodet, one can use MRJAR with FFM. Tomcat does this now and it works. Have you considered that?

[jira-importer]

Tamas Cservenak commented

I don't see warning on my macOS either... so who and why have warning? How to reproduce?

[jira-importer]

Elliotte Rusty Harold commented

Just a guess; maybe it has something to do with the specific JDK vendor and how it was installed? I have

$ java --version
openjdk 17.0.13 2024-10-15
OpenJDK Runtime Environment Homebrew (build 17.0.13+0)
OpenJDK 64-Bit Server VM Homebrew (build 17.0.13+0, mixed mode, sharing)

[jira-importer]

Tamas Cservenak commented

➜  ~ java --version
openjdk 17.0.13 2024-10-15
OpenJDK Runtime Environment Temurin-17.0.13+11 (build 17.0.13+11)
OpenJDK 64-Bit Server VM Temurin-17.0.13+11 (build 17.0.13+11, mixed mode)
➜  ~ mvn -v
Apache Maven 4.0.0-rc-3-SNAPSHOT (1f157ad60161890d6c3b71d4be374ad026385c60)
Maven home: /Users/cstamas/Tools/apache-maven-4.0.0-rc-3-SNAPSHOT
Java version: 17.0.13, vendor: Eclipse Adoptium, runtime: /Users/cstamas/.sdkman/candidates/java/17.0.13-tem
Default locale: en_HU, platform encoding: UTF-8
OS name: "mac os x", version: "15.2", arch: "x86_64", family: "mac"
➜  ~ 

No warnings.

But this raises another question we already had a round about: why building on "least version supported"? I think we all build on latest LTS that is Java 21...

[jira-importer]

Elliotte Rusty Harold commented

Users will use the least versions supported, do it behooves us to make sure this works