Including sshd-sftp with quarkus-sshd: classloader issues

[erik-wramner]

I'm trying to embed an SFTP server based on Apache MINA (io.quarkiverse.sshd:quarkus-sshd) in a Quarkus application. Since it is not included out of the box, I'm importing org.apache.sshd:sshd-sftp. At first glance, it seems fine, but there are weird classloader issues. Even if I add exclusions in Maven, I run into them.

I'm trying to load a ssh-ed25519 public key in a unit test (or live):

var publicKeyEntry = PublicKeyEntry.parsePublicKeyEntry(key);
var publicKey = publicKeyEntry.resolvePublicKey(null, null, null);

Without the sshd-sftp dependency, this works. If the dependency is added, it fails with:

java.security.spec.InvalidKeySpecException: key spec not recognised: class net.i2p.crypto.eddsa.spec.EdDSAPublicKeySpec
		at net.i2p.crypto.eddsa.KeyFactory.engineGeneratePublic(KeyFactory.java:52)
		at java.base/java.security.KeyFactory.generatePublic(KeyFactory.java:345)

In code that should work as the class is there:

    protected PublicKey engineGeneratePublic(KeySpec keySpec)
            throws InvalidKeySpecException {
        if (keySpec instanceof EdDSAPublicKeySpec) {
            return new EdDSAPublicKey((EdDSAPublicKeySpec) keySpec);
        }
        if (keySpec instanceof X509EncodedKeySpec) {
            return new EdDSAPublicKey((X509EncodedKeySpec) keySpec);
        }
        throw new InvalidKeySpecException("key spec not recognised: " + keySpec.getClass());
    }

It sounds as a classloader bug, but I can't see how to get around it? I assume the class is loaded both by the extension classloader and another classloader, but it is not clear to me how to work around it? Any ideas?

EDIT: modifying quarkus-sshd to pull in sshd-sftp didn't help, same error.

[erik-wramner]

Found it. At least in development, setting quarkus.class-loading.parent-first-artifacts=net.i2p.crypto:eddsa does the job.