Spring Cloud Config Server打包运行JCE无法认证BC提供者问题求助

环境与配置 #

pom.xml #

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>3.0.3</version>
    <relativePath/> <!-- lookup parent from repository -->
  </parent>
  <groupId>com.org</groupId>
  <artifactId>config</artifactId>
  <version>0.0.1-SNAPSHOT</version>
  <name>config</name>
  <description>Demo project for Spring Boot</description>
  <properties>
    <java.version>17</java.version>
    <spring-cloud.version>2022.0.1</spring-cloud.version>
  </properties>
  <dependencies>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.cloud</groupId>
      <artifactId>spring-cloud-starter-config</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.cloud</groupId>
      <artifactId>spring-cloud-config-server</artifactId>
    </dependency>

    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-test</artifactId>
      <scope>test</scope>
    </dependency>
  </dependencies>
  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-dependencies</artifactId>
        <version>${spring-cloud.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

  <build>
    <plugins>
      <plugin>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-maven-plugin</artifactId>
      </plugin>
    </plugins>
  </build>

</project>

application.yml #

server:
  port: 8080

spring:
  profiles:
    active: composite
  application:
    name: config-server
  cloud:
    config:
      server:
        composite:
          - type: git
            uri: file://${user.home}/local-config-repo
            defaultLabel: master
            search-paths:
              - roomie*
          - type: git
            uri: git@github.com:Org-Engineering/config-repo.git
            clone-on-start: true
            strictHostKeyChecking: false
            refreshRate: 15
            defaultLabel: master
            search-paths:
              - roomie*

security:
  provider:
    N=org.bouncycastle.jce.provider.BouncyCastleProvider:

问题现象 #

在IntelliJ IDEA中直接运行应用时服务正常，但执行mvn clean install生成jar包后，通过java -jar ...运行时抛出错误：

org.eclipse.jgit.api.errors.TransportException: git@github.com:Org-Engineering/config-repo.git: DefaultAuthFuture[ssh-connection]: Failed (NoSuchProviderException) to execute: JCE cannot authenticate the provider BC

已尝试在application.yml中添加security.provider.N配置，以及在主类中添加Security.addProvider(new BouncyCastleProvider());静态代码块，但均无效。

原因分析 #

1. IDE与Jar运行的类路径差异：IDE运行时可能通过全局依赖、其他关联模块或IDE自带库间接引入了BouncyCastle（BC）相关包，而独立Jar包的类路径是严格依赖pom.xml定义的，缺少BC的显式依赖。
2. 配置格式错误：application.yml中的security.provider配置格式不符合规范，无法正确加载BC提供者。
3. 加载时机问题：静态代码块的执行时机可能晚于JGit初始化SSH连接的时间，导致JGit尝试使用BC提供者时，该提供者尚未被注册到JCE。

解决方案 #

1. 显式引入BouncyCastle依赖 #

在pom.xml的<dependencies>节点中添加BC的核心依赖（适配Java 17的版本）：

<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcprov-jdk15on</artifactId>
    <version>1.70</version>
</dependency>
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk15on</artifactId>
    <version>1.70</version>
</dependency>

2. 修正application.yml的安全配置格式 #

将原错误的security.provider配置替换为正确格式：

security:
  providers:
    - org.bouncycastle.jce.provider.BouncyCastleProvider

3. 确保BC提供者提前加载 #

修改主类，确保BC提供者在JGit初始化前完成注册：

import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.cloud.config.server.EnableConfigServer;

import java.security.Security;

@SpringBootApplication
@EnableConfigServer
public class ConfigApplication {

    static {
        // 检查并注册BC提供者，避免重复注册
        if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
            Security.addProvider(new BouncyCastleProvider());
        }
    }

    public static void main(String[] args) {
        SpringApplication.run(ConfigApplication.class, args);
    }
}

4. 验证Maven打包配置 #

确保Spring Boot Maven插件完整打包所有依赖，可在<build>节点中添加配置：

<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
            <configuration>
                <includeSystemScope>true</includeSystemScope>
            </configuration>
        </plugin>
    </plugins>
</build>

内容的提问来源于stack exchange，提问作者Keshavram Kuduwa