添加SendGrid Maven依赖后Java服务Fat Jar运行抛出java.lang.SecurityException问题求助

I’ve dealt with this exact problem before—here’s a breakdown of why it happens and how to fix it:

Root Cause #

The SendGrid Java library (or one of its transitive dependencies) includes signed JAR files. When you package everything into a single Fat Jar, merging these signed artifacts breaks their original digital signatures. The JVM checks for signature files like .SF, .DSA, and .RSA in the META-INF directory, and throws this error because the merged jar’s contents no longer match the original signed metadata.

Solution 1: Exclude Signature Files with Maven Shade Plugin #

If you’re using the maven-shade-plugin to build your Fat Jar, add a filter to exclude all signature-related files from the final artifact. Here’s the full configuration:

<build>
    <plugins>
        <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-shade-plugin</artifactId>
            <version>3.4.1</version> <!-- Use the latest stable version -->
            <executions>
                <execution>
                    <phase>package</phase>
                    <goals>
                        <goal>shade</goal>
                    </goals>
                    <configuration>
                        <filters>
                            <filter>
                                <artifact>*:*</artifact>
                                <excludes>
                                    <exclude>META-INF/*.SF</exclude>
                                    <exclude>META-INF/*.DSA</exclude>
                                    <exclude>META-INF/*.RSA</exclude>
                                </excludes>
                            </filter>
                        </filters>
                        <!-- Add your main class here if you need to set it in the manifest -->
                        <transformers>
                            <transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
                                <mainClass>com.yourcompany.YourMainApplicationClass</mainClass>
                            </transformer>
                        </transformers>
                    </configuration>
                </execution>
            </executions>
        </plugin>
    </plugins>
</build>

This tells the shade plugin to strip out all signature files from any dependency, preventing the JVM from validating broken signatures.

Solution 2: Spring Boot Maven Plugin (For Spring Boot Apps) #

If your project is a Spring Boot application, the spring-boot-maven-plugin usually handles this automatically, but if you still hit the error, explicitly exclude the signature files:

<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
            <version>3.2.0</version> <!-- Match your Spring Boot version -->
            <configuration>
                <excludes>
                    <exclude>
                        <groupId>*</groupId>
                        <artifactId>*</artifactId>
                        <excludes>
                            <exclude>META-INF/*.SF</exclude>
                            <exclude>META-INF/*.DSA</exclude>
                            <exclude>META-INF/*.RSA</exclude>
                        </excludes>
                    </exclude>
                </excludes>
            </configuration>
        </plugin>
    </plugins>
</build>

Verification Steps #

After updating your pom.xml:

1. Clean your project: mvn clean
2. Rebuild the Fat Jar: mvn package
3. Run the jar: java -jar target/your-application-jar-name.jar

This should resolve the SecurityException since the invalid signature files are no longer present in the final jar.

内容的提问来源于stack exchange，提问作者Uday Solanki