After upgrade from Hibernate 2.1, I'm now getting
SecurityException for the CGLIB enhanced classes, which
cannot live in the same package as the signed class.

This doesn't appear to be a FAQ?

I suppose I have to disable CGLIB, but is there something
I overlooked?

Martin


Hibernate version: 3.0.5

Full stack trace of any exception that occurs:

create proxy factory for:dinmar.oacis.common.empi.LinkMerge
org.hibernate.HibernateException: CGLIB Enhancement failed: dinmar.oacis.common.empi.LinkMerge
at org.hibernate.proxy.CGLIBLazyInitializer.getProxyFactory(CGLIBLazyInitializer.java:108)
at org.hibernate.proxy.CGLIBProxyFactory.postInstantiate(CGLIBProxyFactory.java:42)
at org.hibernate.tuple.PojoTuplizer.buildProxyFactory(PojoTuplizer.java:144)
at org.hibernate.tuple.AbstractTuplizer.<init>(AbstractTuplizer.java:83)
at org.hibernate.tuple.PojoTuplizer.<init>(PojoTuplizer.java:54)
at org.hibernate.tuple.TuplizerLookup.create(TuplizerLookup.java:47)
at org.hibernate.tuple.EntityMetamodel.<init>(EntityMetamodel.java:218)
at org.hibernate.persister.entity.BasicEntityPersister.<init>(BasicEntityPersister.java:400)
at org.hibernate.persister.entity.SingleTableEntityPersister.<init>(SingleTableEntityPersister.java:104)
at org.hibernate.persister.PersisterFactory.createClassPersister(PersisterFactory.java:55)
at org.hibernate.impl.SessionFactoryImpl.<init>(SessionFactoryImpl.java:211)
at org.hibernate.cfg.Configuration.buildSessionFactory(Configuration.java:1005)
at dinmar.oacis.core.config.oacfg_Hibernate$HibernateStore.<init>(oacfg_Hibernate.java:226)
at dinmar.oacis.core.config.oacfg_Hibernate.reloadConfig(oacfg_Hibernate.java:142)
at dinmar.oacis.core.config.oaSiteConfigManager$Notifier.run(oaSiteConfigManager.java:64)
at java.lang.Thread.run(Thread.java:595)
Caused by: net.sf.cglib.core.CodeGenerationException: java.lang.reflect.InvocationTargetException-->null
at net.sf.cglib.core.AbstractClassGenerator.create(AbstractClassGenerator.java:236)
at net.sf.cglib.proxy.Enhancer.createHelper(Enhancer.java:373)
at net.sf.cglib.proxy.Enhancer.create(Enhancer.java:281)
at net.sf.cglib.proxy.Enhancer.create(Enhancer.java:640)
at org.hibernate.proxy.CGLIBLazyInitializer.getProxyFactory(CGLIBLazyInitializer.java:94)
... 15 more
Caused by: java.lang.reflect.InvocationTargetException
at sun.reflect.GeneratedMethodAccessor40.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at net.sf.cglib.core.ReflectUtils.defineClass(ReflectUtils.java:373)
at net.sf.cglib.core.AbstractClassGenerator.create(AbstractClassGenerator.java:218)
... 19 more
Caused by: java.lang.SecurityException: class "dinmar.oacis.common.empi.LinkMerge$$EnhancerByCGLIB$$a4816f47"'s signer i
nformation does not match signer information of other classes in the same package
at java.lang.ClassLoader.checkCerts(ClassLoader.java:775)
at java.lang.ClassLoader.preDefineClass(ClassLoader.java:487)
at java.lang.ClassLoader.defineClass(ClassLoader.java:614)

And my follow-up question is:

How do I turn off cglib?

For instance, in hibernate.properties:

hibernate.cglib.use_reflection_optimizer false

Doesn't help.

Just sign cglib jar, all generated classes are defined in cglib protection domain.

Thanks!

signing cglib-2.1.jar
and hibernate3.jar
did indeed fix the problem, even though I do not understand the
protection mechanism, what is checked and how this could then pass.

Also, as a side-note, org.hibernate.tuple.PojoTuplizer does not
honor the hibernate.cglib.use_reflection_optimizer property, at least in
this context and 3.0.5. Shouldn't it?