bcpkix-jdk18on 1.78.1: 3 files found with path 'META-INF/versions/9/OSGI-INF/MANIFEST.MF'

[cheeyi]

Hi, my team has been using BC for a few years, and we keep it updated from time to time. Our old version was 1.77 and today we wanted to upgrade to 1.78.1, but Gradle sync on an Android library project is currently failing:

Execution failed for task ':app:mergeDevDebugJavaResource'.
> A failure occurred while executing com.android.build.gradle.internal.tasks.MergeJavaResWorkAction
   > 3 files found with path 'META-INF/versions/9/OSGI-INF/MANIFEST.MF' from inputs:
      - /Users/cheeyi/.gradle/caches/transforms-4/ee9bc3a4401575fa3ac2c180e3b1b03a/transformed/jetified-bcpkix-jdk18on-1.78.1.jar
      - /Users/cheeyi/.gradle/caches/transforms-4/02b634b1e824d63f602c8f18f1902446/transformed/jetified-bcutil-jdk18on-1.78.1.jar
      - /Users/cheeyi/.gradle/caches/transforms-4/73a4df265e1d83e0d61ef8f741984bdf/transformed/jetified-bcprov-jdk18on-1.78.1.jar
     Adding a packaging block may help, please refer to
     https://developer.android.com/reference/tools/gradle-api/8.4/com/android/build/api/dsl/Packaging
     for more information

Adding an exclusion to lib/build.gradle did not work:

    packaging {
        resources.excludes.add("META-INF/versions/9/OSGI-INF/MANIFEST.MF")
    }

Has anyone else run into a similar issue?

Our dependency used is

implementation("org.bouncycastle:bcpkix-jdk18on:1.78.1")

[cheeyi]

Fixed by adding the excludes block to the app/build.gradle file instead of lib/build.gradle, but I'm curious why 1.78 and 1.78.1 have this issue while 1.77 did not.

    packaging {
        resources.excludes.add("META-INF/versions/9/OSGI-INF/MANIFEST.MF")
    }

Edit: If you're building your lib as an AAR adding it to lib/build.gradle should work, but in our case we also have a test harness app that is consuming the lib directly via git submodule so in that case we needed to also add the exclude option to app/build.gradle.

[dghgit]

So these are the multi-release manifests for OSGi. What version of the JVM is your Android platform based on?

[cheeyi]

So these are the multi-release manifests for OSGi. What version of the JVM is your Android platform based on?

Hi @dghgit, we're using Java 17:

    compileOptions {
        sourceCompatibility = JavaVersion.VERSION_17
        targetCompatibility = JavaVersion.VERSION_17
    }

    kotlinOptions {
        jvmTarget = JavaVersion.VERSION_17.toString()
    }

[dghgit]

Okay, so it's the 8on jar you want, yes the best thing to do is get Android to ignore the extra files then. I guess they haven't got the memo on this one yet...

[cheeyi]

Thanks, I'm not familiar with JAR packaging and OSGi so it's good to get confirmation that this is an acceptable workaround for now. I was mostly curious why 1.77 and prior versions didn't have this issue but all of a sudden 1.78 and 1.78.1 both exhibit the same issues with our Android project, but sounds like it may fix itself eventually in the future?

[dghgit]

So 1.77 and earlier wasn't properly supporting multi-release OSGi. 1.78 and later does (or in the case of 1.78 at least tries to). Ideally the Android tools would recognise the files for what they are one day... but in our case we have to keep inserting them for now.

[cheeyi]

Thanks @dghgit, that makes a lot of sense now!