jruby-openssl 0.16.2-java → 0.19.0-java
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/History.md +104 -0
- data/Mavenfile +180 -93
- data/README.md +100 -27
- data/Rakefile +77 -26
- data/lib/jopenssl/load.rb +13 -57
- data/lib/jopenssl/version.rb +2 -7
- data/lib/jopenssl.jar +0 -0
- data/lib/openssl/config.rb +13 -5
- data/lib/openssl/ssl.rb +21 -11
- data/lib/openssl.rb +43 -0
- data/pom.xml +656 -108
- metadata +20 -21
- data/lib/openssl/pkcs12.rb +0 -101
- /data/{lib → vendor}/org/bouncycastle/bcpkix-jdk18on/1.85/bcpkix-jdk18on-1.85.jar +0 -0
- /data/{lib → vendor}/org/bouncycastle/bcprov-jdk18on/1.85/bcprov-jdk18on-1.85.jar +0 -0
- /data/{lib → vendor}/org/bouncycastle/bctls-jdk18on/1.85/bctls-jdk18on-1.85.jar +0 -0
- /data/{lib → vendor}/org/bouncycastle/bcutil-jdk18on/1.85/bcutil-jdk18on-1.85.jar +0 -0
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: e2a2b1fb32208ee3d9a8d7d396c254a3abf7a2663cce26bafda818c8306964d4
|
|
4
|
+
data.tar.gz: 7047f2d22daf89569aa1a100572dedcd637247a6bb3b5a95899a70d7726bfc72
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: eb37c06db9d13bf09b02868f778869b7cb0d71fc6c22b216099348824f67b387aaf39e987f1a544e28bc780f6aa371adf65aab13ede236f164d20aa1c3347d64
|
|
7
|
+
data.tar.gz: 9efbab3330d20e966c98df007491bd2e76a244a30562aa0aca36a09947fe16e657f26c8b9f96f39ae6c7bbc16e0fd90322365cbea332412b22a5d56d1d845db0
|
data/History.md
CHANGED
|
@@ -1,3 +1,107 @@
|
|
|
1
|
+
## 0.19.0
|
|
2
|
+
|
|
3
|
+
FIPS support, distributed as a **separate, dual GPL/commercial artifact**.
|
|
4
|
+
|
|
5
|
+
Alongside FIPS, this release switches TLS to BouncyCastle's JSSE provider by
|
|
6
|
+
default (session reuse, ChaCha20-Poly1305, session/servername callbacks), and
|
|
7
|
+
lands an extensive X.509 verification hardening (name constraints, CRL scope,
|
|
8
|
+
path-length, partial-chain handling and improved hostname verification).
|
|
9
|
+
|
|
10
|
+
NOTE: due considerable amount of changes please treat 0.19 as a beta release.
|
|
11
|
+
|
|
12
|
+
- [feat] FIPS support as a separate `jruby-openssl` artifact bundling BC-FIPS
|
|
13
|
+
- [feat] leverage BouncyCastle's JSSE provider by default for SSL/TLS
|
|
14
|
+
- [build] restore binary compatibility with BC < 1.84
|
|
15
|
+
- [feat] `to_java` conversions (`X500Principal`, `KeyPair`, `MessageDigest`, `Mac`)
|
|
16
|
+
- [feat] pluggable internal logging via a logger interface
|
|
17
|
+
- [feat] route logs through `java.util.logging` (`jruby.openssl.log.logger=jul`)
|
|
18
|
+
- [chore] remove long-deprecated methods and legacy JRuby/JOpenSSL constants
|
|
19
|
+
|
|
20
|
+
### SSL / TLS
|
|
21
|
+
|
|
22
|
+
- [feat] proper TLS session reuse with the BC provider
|
|
23
|
+
- [compat] add `SSLSession#to_der`, `#to_pem` and `#to_text`
|
|
24
|
+
- [feat] (re)implement SSLContext session callbacks
|
|
25
|
+
- [feat] start calling `servername_cb`
|
|
26
|
+
- [feat] server-only `renegotiation_cb`
|
|
27
|
+
- [feat] TLS 1.2 ChaCha20-Poly1305 cipher suites
|
|
28
|
+
- [fix] `read_nonblock(exception: false)` throwing on TLS 1.3
|
|
29
|
+
- [fix] SSL write data loss on non-blocking partial flush
|
|
30
|
+
- [fix] keep TLS 1.3 with `ciphers=` and a default timeout
|
|
31
|
+
- [fix] `SSLSocket#cipher` returns `[name, version, bits, alg_bits]`
|
|
32
|
+
- [fix] raise on `sysread`/`syswrite` before handshake
|
|
33
|
+
- [fix] `session_reused?` raises before handshake
|
|
34
|
+
- [fix] close connection on hostname-verification failure
|
|
35
|
+
- [compat] emulate early `verify_hostname` during `SSLSocket#connect`
|
|
36
|
+
- [compat] normalize IP address in SAN verify to match MRI
|
|
37
|
+
- [compat] `undef` `SSLContext#dup`/`clone` and reject option writers
|
|
38
|
+
- [compat] `set_params` must OR options (not overwrite them)
|
|
39
|
+
- [fix] serialize concurrent SSL reads/writes to avoid buffer corruption
|
|
40
|
+
- [fix] grow the application read buffer on TLS unwrap `BUFFER_OVERFLOW`
|
|
41
|
+
- [compat] honor `verify_callback` on the `ca_file`/`ca_path` lookup path
|
|
42
|
+
|
|
43
|
+
### X.509 / certificate verification
|
|
44
|
+
|
|
45
|
+
- [compat] implement `nameConstraints` verification
|
|
46
|
+
- [fix] properly encode `nameConstraints` extension
|
|
47
|
+
- [compat] enforce dNSName name constraints against EE subject CN
|
|
48
|
+
- [compat] enforce CRL issuing-distribution-point scope
|
|
49
|
+
- [fix] align `cert_crl` critical-extension and `removeFromCRL` handling
|
|
50
|
+
- [fix] proper path-length constraint on self-signed roots
|
|
51
|
+
- [fix] make `V_FLAG_PARTIAL_CHAIN` verify correctly
|
|
52
|
+
- [fix] canonicalize X.509 name before hashed-dir lookup
|
|
53
|
+
- [fix] `StoreContext#getExtraData` IndexOutOfBoundsException
|
|
54
|
+
- [fix] cert time checks when not-before/after are equal
|
|
55
|
+
- [compat] `StoreContext#verify` raises on internal error
|
|
56
|
+
- [compat] implement `Store#add_path` for cert lookup
|
|
57
|
+
- [compat] `verify_result` reporting with `VERIFY_NONE` (#25)
|
|
58
|
+
- [compat] set `V_ERR_HOSTNAME_MISMATCH` on hostname fail
|
|
59
|
+
- [compat] expose missing `V_ERR`/`V_FLAG` constants to Ruby
|
|
60
|
+
- [compat] keep X.509 extension order for certs
|
|
61
|
+
- [fix] don't clobber shared (store) verify settings
|
|
62
|
+
- [compat] drop `V_FLAG_CRL_CHECK_ALL` on `DEFAULT_CERT_STORE`
|
|
63
|
+
- [fix] report a malformed `subjectAltName` as an invalid extension
|
|
64
|
+
- [fix] avoid false revocation from `certificateIssuer` CRL entries
|
|
65
|
+
- [fix] proper escaping in `X509::Name`
|
|
66
|
+
- [fix] ASCII-only X.509 name canonicalization
|
|
67
|
+
- [compat] align `X509::StoreContext` state exposure
|
|
68
|
+
- [fix] `subjectAltName` with an `otherName` entry breaking hostname verification (#324)
|
|
69
|
+
- [fix] format the `nameConstraints` extension value like OpenSSL does
|
|
70
|
+
|
|
71
|
+
### PKey / Cipher / ASN.1
|
|
72
|
+
|
|
73
|
+
- [feat] AES-CCM cipher mode support (#96)
|
|
74
|
+
- [feat] implement `OpenSSL::PKey::EC::Point#invert!`
|
|
75
|
+
- [compat] `PKey.generate_key`/`generate_parameters` (with params/String)
|
|
76
|
+
- [compat] support HMAC key with the generic PKey API
|
|
77
|
+
- [compat] implement `PKey::EC#check_key` validation
|
|
78
|
+
- [compat] support `PKey::EC.new` with 4 args
|
|
79
|
+
- [fix] RSA-PSS reject negative salt and align `sign_pss` default
|
|
80
|
+
- [fix] handle mismatched PSS content/MGF1 digests via fallback
|
|
81
|
+
- [fix] `Cipher#key=` rejects any length mismatch
|
|
82
|
+
- [fix] reject over-length IV for AEAD ciphers
|
|
83
|
+
- [compat] align `Cipher#iv=` and AEAD-only writers
|
|
84
|
+
- [fix] manual block cipher (buffer/padding) edge cases under CBC/ECB
|
|
85
|
+
- [compat] match MRI no-salt cipher derivation
|
|
86
|
+
- [compat] derive cipher IV length from the real block size
|
|
87
|
+
- [fix] PBKDF2 raw password bytes and reject `< 0` iterations
|
|
88
|
+
- [compat] OpenSSL default PBKDF2 iterations for key export
|
|
89
|
+
- [fix] bound ASN.1 nesting depth and fix truncated-input error class
|
|
90
|
+
- [fix] add missing ASN.1 object-ids for SHA-2
|
|
91
|
+
- [compat] switch `BN.pseudo_rand` to secure random
|
|
92
|
+
- [compat] allow CRT parameter setters on RSA
|
|
93
|
+
- [fix] Cipher authentication-tag reset behavior
|
|
94
|
+
- [fix] break `OpenSSL::Config` `.include` reference cycles
|
|
95
|
+
|
|
96
|
+
### PKCS7 / PKCS12 / OCSP
|
|
97
|
+
|
|
98
|
+
- [feat] implement missing PKCS7 wrapper methods
|
|
99
|
+
- [feat] implement `X509::Request#to_text`
|
|
100
|
+
- [fix] protect PKCS12 key entries with password
|
|
101
|
+
- [fix] wrap mode for PKCS7 key transport
|
|
102
|
+
- [compat] handle `File` object in `PKCS7.obj2bio`
|
|
103
|
+
- [fix] preserve OCSP `NOCERTS` with explicit flags
|
|
104
|
+
|
|
1
105
|
## 0.16.2
|
|
2
106
|
|
|
3
107
|
- [fix] PKey.generate_key accepts key as parameters (#366)
|
data/Mavenfile
CHANGED
|
@@ -1,125 +1,122 @@
|
|
|
1
1
|
#-*- mode: ruby -*-
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
load File.expand_path('lib/jopenssl/version.rb', File.dirname(__FILE__))
|
|
4
|
+
|
|
5
|
+
gemspec jar: 'jopenssl'
|
|
6
|
+
# gemspec defaults to 'rubygems' groupId
|
|
7
|
+
# `id` resets the version, so pass full GAV (gem 0.20.0.dev -> Maven -SNAPSHOT)
|
|
8
|
+
maven_version = JOpenSSL::VERSION
|
|
9
|
+
maven_version += "-SNAPSHOT" if JOpenSSL::VERSION.match?(/[a-zA-Z]/)
|
|
10
|
+
id "org.jruby.openssl:jruby-openssl:#{maven_version}"
|
|
4
11
|
|
|
5
12
|
distribution_management do
|
|
6
|
-
snapshot_repository :
|
|
7
|
-
repository :
|
|
13
|
+
snapshot_repository id: :ossrh, url: 'https://oss.sonatype.org/content/repositories/snapshots'
|
|
14
|
+
repository id: :ossrh, url: 'https://oss.sonatype.org/service/local/staging/deploy/maven2/'
|
|
8
15
|
end
|
|
9
16
|
|
|
10
17
|
java_target = '1.8'
|
|
11
18
|
gen_sources = '${basedir}/target/generated-sources' # hard-coded in AnnotationBinder
|
|
12
19
|
|
|
13
|
-
plugin
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
#invoker_main << ' -classpath '
|
|
18
|
-
invoker_main << ' org.jruby.anno.InvokerGenerator'
|
|
19
|
-
invoker_main << " #{gen_sources}/annotated_classes.txt ${project.build.outputDirectory}"
|
|
20
|
-
|
|
21
|
-
dependency 'org.jruby', 'jruby-core', '${jruby.version}'
|
|
22
|
-
|
|
23
|
-
execute_goal :java, :id => 'invoker-generator', :phase => 'process-classes',
|
|
24
|
-
:mainClass => 'org.jruby.anno.InvokerGenerator', :classpathScope => 'compile',
|
|
25
|
-
#:arguments => [ '${gen.sources}/annotated_classes.txt', '${project.build.outputDirectory}' ] do
|
|
26
|
-
:commandlineArgs => "#{gen_sources}/annotated_classes.txt ${project.build.outputDirectory}",
|
|
27
|
-
:classpathScope => 'runtime', :additionalClasspathElements => [ '${project.build.outputDirectory}' ],
|
|
28
|
-
:includeProjectDependencies => false, :includePluginDependencies => true do
|
|
29
|
-
|
|
30
|
-
#systemProperties do
|
|
31
|
-
# property '-Djruby.bytecode.version=${compiler.target}'
|
|
32
|
-
#end
|
|
33
|
-
=end
|
|
34
|
-
|
|
35
|
-
execute_goal :exec, :id => 'invoker-generator', :phase => 'process-classes',
|
|
36
|
-
:executable => 'java', :classpathScope => 'compile',
|
|
37
|
-
:arguments => [ "-Djruby.bytecode.version=#{java_target}",
|
|
20
|
+
plugin 'org.codehaus.mojo:exec-maven-plugin', '3.5.0' do
|
|
21
|
+
execute_goal :exec, id: 'invoker-generator', phase: 'process-classes',
|
|
22
|
+
executable: 'java', classpathScope: 'compile',
|
|
23
|
+
arguments: [ "-Djruby.bytecode.version=#{java_target}",
|
|
38
24
|
'-classpath', xml( '<classpath/>' ),
|
|
39
25
|
'org.jruby.anno.InvokerGenerator',
|
|
40
26
|
"#{gen_sources}/annotated_classes.txt",
|
|
41
27
|
'${project.build.outputDirectory}' ]
|
|
28
|
+
|
|
29
|
+
# inlines the shim call sites straight into the compiled classes
|
|
30
|
+
execute_goal :exec, id: 'shim-inliner', phase: 'process-classes',
|
|
31
|
+
executable: 'java', classpathScope: 'compile',
|
|
32
|
+
skip: '${shim.inline.skip}', # -Dshim.inline.skip=true to bypass
|
|
33
|
+
arguments: [ '-classpath', xml( '<classpath/>' ),
|
|
34
|
+
'${basedir}/src/build/java/ShimInliner.java',
|
|
35
|
+
'${project.build.outputDirectory}' ]
|
|
42
36
|
end
|
|
43
37
|
|
|
44
|
-
plugin
|
|
45
|
-
execute_goal 'add-source', :
|
|
38
|
+
plugin 'org.codehaus.mojo:build-helper-maven-plugin', '3.6.1' do
|
|
39
|
+
execute_goal 'add-source', phase: 'process-classes', sources: [ gen_sources ]
|
|
40
|
+
end
|
|
41
|
+
|
|
42
|
+
# building needs JDK 11+ (module-info + the ShimInliner source launcher)
|
|
43
|
+
plugin :enforcer, '3.5.0' do
|
|
44
|
+
execute_goal 'enforce', id: 'enforce-java-version',
|
|
45
|
+
rules: { requireJavaVersion: { version: '[11,)' } }
|
|
46
46
|
end
|
|
47
47
|
|
|
48
48
|
compiler_configuration = {
|
|
49
|
-
:
|
|
50
|
-
:
|
|
51
|
-
:
|
|
52
|
-
:
|
|
53
|
-
|
|
54
|
-
:
|
|
55
|
-
:
|
|
49
|
+
source: '1.8', target: java_target, release: '8',
|
|
50
|
+
encoding: 'UTF-8', debug: true,
|
|
51
|
+
showWarnings: true, showDeprecation: true,
|
|
52
|
+
excludes: [ 'module-info.java' ],
|
|
53
|
+
#jdkToolchain: { version: '[1.7,11)' },
|
|
54
|
+
generatedSourcesDirectory: gen_sources,
|
|
55
|
+
annotationProcessors: [ 'org.jruby.anno.AnnotationBinder' ]
|
|
56
56
|
}
|
|
57
|
-
compiler_configuration.delete(:release) if ENV_JAVA['java.specification.version'] == '1.8'
|
|
58
|
-
|
|
59
|
-
plugin( :compiler, '3.15.0', compiler_configuration) do
|
|
60
|
-
|
|
61
|
-
#execute_goal :compile, :id => 'annotation-binder', :phase => 'compile',
|
|
62
|
-
# :generatedSourcesDirectory => gen_sources, #:outputDirectory => gen_sources,
|
|
63
|
-
# :annotationProcessors => [ 'org.jruby.anno.AnnotationBinder' ],
|
|
64
|
-
# :proc => 'only', # :compilerReuseStrategy => 'alwaysNew',
|
|
65
|
-
# :useIncrementalCompilation => false, :fork => true, :verbose => true,
|
|
66
|
-
# :compilerArgs => [ '-XDignore.symbol.file=true', '-J-Dfile.encoding=UTF-8' ]
|
|
67
57
|
|
|
58
|
+
plugin :compiler, '3.15.0', compiler_configuration do
|
|
68
59
|
execute_goal :compile,
|
|
69
|
-
:
|
|
70
|
-
:
|
|
71
|
-
:
|
|
72
|
-
:
|
|
60
|
+
id: 'compile-populators', phase: 'process-classes',
|
|
61
|
+
includes: [ 'org/jruby/gen/**/*.java' ],
|
|
62
|
+
optimize: true,
|
|
63
|
+
compilerArgs: [ '', '-XDignore.symbol.file=true' ]
|
|
73
64
|
end
|
|
74
65
|
|
|
75
|
-
plugin :
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
66
|
+
plugin! :jar, '3.4.1',
|
|
67
|
+
'outputDirectory' => 'lib', 'finalName' => 'jopenssl',
|
|
68
|
+
'excludes' => [ 'annotated_classes.txt' ],
|
|
69
|
+
'archive' => { 'manifestEntries' => { 'JOpenSSL-Variant' => 'main' } }
|
|
70
|
+
|
|
71
|
+
plugin! :clean, '2.4',
|
|
72
|
+
'filesets' => [
|
|
73
|
+
{ directory: 'lib', includes: [ 'jopenssl.jar' ] },
|
|
74
|
+
{ directory: 'vendor' },
|
|
75
|
+
{ directory: 'target', includes: [ '*' ] }
|
|
76
|
+
],
|
|
77
|
+
'failOnError' => 'false'
|
|
84
78
|
|
|
85
79
|
jruby_compile_compat = '9.2.1.0'
|
|
86
|
-
jar 'org.jruby:jruby-core', jruby_compile_compat, :
|
|
80
|
+
jar 'org.jruby:jruby-core', jruby_compile_compat, scope: :provided
|
|
81
|
+
jar 'org.ow2.asm:asm-analysis', '9.8', scope: :provided # build-time only (for ShimInliner)
|
|
87
82
|
# for invoker generated classes we need to add javax.annotation when on Java > 8
|
|
88
|
-
jar 'javax.annotation:javax.annotation-api', '1.3.1', :
|
|
89
|
-
jar 'org.junit.jupiter:junit-jupiter', '5.11.4', :
|
|
83
|
+
jar 'javax.annotation:javax.annotation-api', '1.3.1', scope: :compile
|
|
84
|
+
jar 'org.junit.jupiter:junit-jupiter', '5.11.4', scope: :test
|
|
90
85
|
# a test dependency to provide digest and other stdlib bits, needed when loading OpenSSL in Java unit tests
|
|
91
|
-
jar 'org.jruby:jruby-stdlib', jruby_compile_compat, :
|
|
86
|
+
jar 'org.jruby:jruby-stdlib', jruby_compile_compat, scope: :test
|
|
92
87
|
|
|
93
88
|
plugin :surefire, '3.5.5'
|
|
94
89
|
|
|
95
|
-
|
|
96
|
-
# load error: jopenssl/load -- java.lang.StringIndexOutOfBoundsException
|
|
97
|
-
MVN_JRUBY_VERSION = '9.2.19.0'
|
|
90
|
+
MVN_JRUBY_VERSION = '9.4.14.0'
|
|
98
91
|
|
|
99
92
|
jruby_plugin! :gem do
|
|
100
93
|
# when installing dependent gems we want to use the built in openssl not the one from this lib directory
|
|
101
|
-
execute_goal :
|
|
102
|
-
execute_goals :
|
|
94
|
+
execute_goal id: 'default-package', addProjectClasspath: false, libDirectory: 'something-which-does-not-exists'
|
|
95
|
+
execute_goals id: 'default-push', skip: true
|
|
103
96
|
end
|
|
104
97
|
|
|
105
98
|
# we want to have the snapshots on oss.sonatype.org and the released gems on maven central
|
|
106
99
|
plugin :deploy, '3.1.4' do
|
|
107
|
-
|
|
100
|
+
# gem.deploy.skip is flipped on by the jar-release profile (jar-only deploy)
|
|
101
|
+
execute_goals( :deploy, skip: '${gem.deploy.skip}' )
|
|
108
102
|
end
|
|
109
103
|
|
|
110
|
-
supported_bc_versions = %w{ 1.
|
|
104
|
+
supported_bc_versions = %w{ 1.80 1.81 1.82 1.83 1.84 1.85 }
|
|
111
105
|
|
|
112
106
|
default_bc_version = File.read File.expand_path('lib/jopenssl/version.rb', File.dirname(__FILE__))
|
|
113
107
|
default_bc_version = default_bc_version[/BOUNCY_CASTLE_VERSION\s?=\s?'(.*?)'/, 1]
|
|
114
108
|
|
|
115
|
-
|
|
109
|
+
# reproducible builds: Rakefile passes -Dproject.build.outputTimestamp=$SOURCE_DATE_EPOCH
|
|
110
|
+
properties( 'shim.inline.skip' => 'false',
|
|
111
|
+
'gem.deploy.skip' => 'false', # jar-release profile sets this true
|
|
112
|
+
'jruby.plugins.version' => '3.0.6',
|
|
116
113
|
'jruby.switches' => '-W0', # https://github.com/torquebox/jruby-maven-plugins/issues/94
|
|
117
114
|
'bc.versions' => default_bc_version,
|
|
118
115
|
'invoker.test' => '${bc.versions}',
|
|
119
116
|
# allow to skip all tests with -Dmaven.test.skip
|
|
120
117
|
'invoker.skip' => '${maven.test.skip}',
|
|
121
118
|
'skipRunit' => 'true',
|
|
122
|
-
'runit.dir' => '
|
|
119
|
+
'runit.dir' => 'test/**/test_*.rb',
|
|
123
120
|
'mavengem.wagon.version' => '2.0.2', # for jruby plugin
|
|
124
121
|
'mavengem-wagon.version' => '3.0.0', # for polyglot-ruby
|
|
125
122
|
# use this version of jruby for the jruby-maven-plugins
|
|
@@ -127,26 +124,22 @@ properties( 'jruby.plugins.version' => '3.0.6',
|
|
|
127
124
|
# dump pom.xml when running 'rmvn'
|
|
128
125
|
'polyglot.dump.pom' => 'pom.xml', 'polyglot.dump.readonly' => false )
|
|
129
126
|
|
|
130
|
-
# make sure we have the embedded jars in place before we run runit plugin
|
|
131
127
|
plugin! :dependency do
|
|
132
128
|
execute_goal 'copy-dependencies',
|
|
133
|
-
:
|
|
134
|
-
:
|
|
135
|
-
:
|
|
136
|
-
:
|
|
129
|
+
phase: 'generate-test-resources',
|
|
130
|
+
outputDirectory: '${basedir}/vendor',
|
|
131
|
+
useRepositoryLayout: true,
|
|
132
|
+
includeGroupIds: 'org.bouncycastle'
|
|
137
133
|
end
|
|
138
134
|
|
|
139
|
-
jruby_plugin(:runit) { execute_goal( :test, :runitDirectory => '${runit.dir}' ) }
|
|
140
|
-
|
|
141
135
|
invoker_run_options = {
|
|
142
|
-
:
|
|
143
|
-
:
|
|
144
|
-
:
|
|
145
|
-
:
|
|
136
|
+
id: 'tests-with-different-bc-versions',
|
|
137
|
+
projectsDirectory: 'src/it',
|
|
138
|
+
pomIncludes: [ '*/pom.xml' ],
|
|
139
|
+
streamLogs: true,
|
|
146
140
|
# pass those properties on to the test project
|
|
147
|
-
:
|
|
141
|
+
properties: {
|
|
148
142
|
'jruby.versions' => '${jruby.versions}',
|
|
149
|
-
'jruby.modes' => '${jruby.modes}',
|
|
150
143
|
'jruby.openssl.version' => '${project.version}',
|
|
151
144
|
'bc.versions' => '${bc.versions}',
|
|
152
145
|
'runit.dir' => '${runit.dir}' }
|
|
@@ -155,13 +148,13 @@ invoker_run_options = {
|
|
|
155
148
|
jruby_versions = []
|
|
156
149
|
jruby_versions += %w{ 9.2.19.0 9.2.20.1 }
|
|
157
150
|
jruby_versions += %w{ 9.3.3.0 9.3.13.0 }
|
|
158
|
-
jruby_versions += %w{ 9.4.8.0 9.4.14.0 }
|
|
159
|
-
jruby_versions += %w{ 10.0.
|
|
151
|
+
jruby_versions += %w{ 9.4.8.0 9.4.14.0 9.4.15.0 9.4.16.0 }
|
|
152
|
+
jruby_versions += %w{ 10.0.1.0 10.0.3.0 10.0.5.0 10.0.6.0 }
|
|
160
153
|
|
|
161
154
|
jruby_versions.each do |version|
|
|
162
|
-
profile :
|
|
155
|
+
profile id: "test-#{version}" do
|
|
163
156
|
plugin :invoker, '3.8.1' do
|
|
164
|
-
execute_goals
|
|
157
|
+
execute_goals :install, :run, invoker_run_options
|
|
165
158
|
end
|
|
166
159
|
properties 'jruby.version' => version,
|
|
167
160
|
'jruby.versions' => version,
|
|
@@ -169,10 +162,104 @@ jruby_versions.each do |version|
|
|
|
169
162
|
end
|
|
170
163
|
end
|
|
171
164
|
|
|
172
|
-
profile :
|
|
165
|
+
profile id: 'release' do
|
|
173
166
|
plugin :gpg, '3.1.0' do
|
|
174
|
-
execute_goal :sign, :
|
|
167
|
+
execute_goal :sign, phase: :verify
|
|
175
168
|
end
|
|
176
169
|
end
|
|
177
170
|
|
|
178
|
-
#
|
|
171
|
+
# packages everything (lib/ included) into a self-contained jruby-openssl.jar
|
|
172
|
+
# and deploys it as a plain (non-gem) Maven artifact under org.jruby.openssl
|
|
173
|
+
profile id: 'jar-release' do
|
|
174
|
+
jar_release_dir = '${project.build.directory}/jar-release'
|
|
175
|
+
jar_release_src_dir = '${project.build.directory}/jar-release-sources'
|
|
176
|
+
jar_release_modpath = '${project.build.directory}/jar-release-modpath'
|
|
177
|
+
jar_release_file = '${project.build.directory}/${project.build.finalName}.jar'
|
|
178
|
+
jar_release_sources = '${project.build.directory}/${project.build.finalName}-sources.jar'
|
|
179
|
+
|
|
180
|
+
# ship only what is committed, the same way the gemspec picks its (lib) files
|
|
181
|
+
jar_release_rb = `git ls-files lib`.split("\n").select { |f| f.end_with?('.rb') }
|
|
182
|
+
raise 'no lib/**/*.rb tracked by git - cannot assemble the jar-release' if jar_release_rb.empty?
|
|
183
|
+
jar_release_rb = jar_release_rb.map { |f| f.sub(%r{\Alib/}, '') } # relative to lib directory
|
|
184
|
+
|
|
185
|
+
# same rule for the sources jar - explicit list of committed .java files
|
|
186
|
+
jar_release_src = `git ls-files src/main/java`.split("\n").select { |f| f.end_with?('.java') }
|
|
187
|
+
raise 'no src/main/java/**/*.java tracked by git - cannot assemble the jar-release' if jar_release_src.empty?
|
|
188
|
+
jar_release_src = jar_release_src.map { |f| f.sub(%r{\Asrc/main/java/}, '') } # relative to directory
|
|
189
|
+
|
|
190
|
+
properties 'gem.deploy.skip' => 'true', # publish only the jar, not the gem
|
|
191
|
+
'jar-release.repositoryId' => 'ossrh',
|
|
192
|
+
# release staging by default; override with the snapshots url for SNAPSHOT versions
|
|
193
|
+
'jar-release.url' => 'https://oss.sonatype.org/service/local/staging/deploy/maven2/'
|
|
194
|
+
|
|
195
|
+
plugin :resources, '3.3.1' do
|
|
196
|
+
execute_goal 'copy-resources', id: 'jar-release-classes', phase: 'prepare-package',
|
|
197
|
+
outputDirectory: jar_release_dir,
|
|
198
|
+
resources: [ { directory: '${project.build.outputDirectory}' } ]
|
|
199
|
+
execute_goal 'copy-resources', id: 'jar-release-lib', phase: 'prepare-package',
|
|
200
|
+
outputDirectory: jar_release_dir,
|
|
201
|
+
resources: [ { directory: 'lib', includes: jar_release_rb } ]
|
|
202
|
+
# NOTE: maven-source-plugin refuses to run on a gem-packaged project
|
|
203
|
+
execute_goal 'copy-resources', id: 'jar-release-sources', phase: 'prepare-package',
|
|
204
|
+
outputDirectory: jar_release_src_dir,
|
|
205
|
+
resources: [ { directory: 'src/main/java', includes: jar_release_src } ]
|
|
206
|
+
# the lib/*.rb ships in the sources jar too, same as in the jar-release .jar
|
|
207
|
+
execute_goal 'copy-resources', id: 'jar-release-sources-lib', phase: 'prepare-package',
|
|
208
|
+
outputDirectory: jar_release_src_dir,
|
|
209
|
+
resources: [ { directory: 'lib', includes: jar_release_rb } ]
|
|
210
|
+
# the module descriptor source ships in the sources jar as well
|
|
211
|
+
execute_goal 'copy-resources', id: 'jar-release-sources-module', phase: 'prepare-package',
|
|
212
|
+
outputDirectory: jar_release_src_dir,
|
|
213
|
+
resources: [ { directory: 'src/main/module', includes: [ 'module-info.java' ] } ]
|
|
214
|
+
end
|
|
215
|
+
|
|
216
|
+
# a module path for compiling module-info;
|
|
217
|
+
# the full classpath cannot be used as-is (jnr-* jars split jnr.enxio.channels)
|
|
218
|
+
# main sources compile against the 9.2 compat jruby-core (module 'org.jruby'),
|
|
219
|
+
# but the descriptor requires 'org.jruby.dist' - runtime name since 9.4.13
|
|
220
|
+
plugin! :dependency do
|
|
221
|
+
execute_goal 'copy-dependencies', id: 'jar-release-modpath-bc', phase: 'generate-resources',
|
|
222
|
+
outputDirectory: jar_release_modpath,
|
|
223
|
+
includeGroupIds: 'org.bouncycastle'
|
|
224
|
+
execute_goal 'copy', id: 'jar-release-modpath-jruby', phase: 'generate-resources',
|
|
225
|
+
outputDirectory: jar_release_modpath,
|
|
226
|
+
artifactItems: [ { groupId: 'org.jruby', artifactId: 'jruby-core', version: MVN_JRUBY_VERSION } ]
|
|
227
|
+
end
|
|
228
|
+
|
|
229
|
+
# module-info targets Java 9 bytecode, so compiled separately from the Java 8
|
|
230
|
+
# main sources; patched onto the already compiled classes dir
|
|
231
|
+
plugin 'org.codehaus.mojo:exec-maven-plugin' do
|
|
232
|
+
execute_goal :exec, id: 'jar-release-module-info', phase: 'process-classes',
|
|
233
|
+
executable: 'javac',
|
|
234
|
+
arguments: [ '--release', '9',
|
|
235
|
+
'--module-path', jar_release_modpath,
|
|
236
|
+
'--patch-module', 'org.jruby.ext.openssl=${project.build.outputDirectory}',
|
|
237
|
+
'-d', jar_release_dir,
|
|
238
|
+
'${basedir}/src/main/module/module-info.java' ]
|
|
239
|
+
end
|
|
240
|
+
|
|
241
|
+
plugin :jar, '3.4.1' do
|
|
242
|
+
execute_goal :jar, id: 'jar-release', phase: 'package',
|
|
243
|
+
classesDirectory: jar_release_dir,
|
|
244
|
+
outputDirectory: '${project.build.directory}',
|
|
245
|
+
finalName: '${project.build.finalName}'
|
|
246
|
+
|
|
247
|
+
execute_goal :jar, id: 'jar-release-sources', phase: 'package',
|
|
248
|
+
classesDirectory: jar_release_src_dir,
|
|
249
|
+
outputDirectory: '${project.build.directory}',
|
|
250
|
+
finalName: '${project.build.finalName}',
|
|
251
|
+
classifier: 'sources'
|
|
252
|
+
end
|
|
253
|
+
|
|
254
|
+
plugin :deploy, '3.1.4' do
|
|
255
|
+
execute_goal 'deploy-file', id: 'jar-release-deploy', phase: 'deploy',
|
|
256
|
+
file: jar_release_file,
|
|
257
|
+
sources: jar_release_sources,
|
|
258
|
+
groupId: '${project.groupId}',
|
|
259
|
+
artifactId: '${project.artifactId}',
|
|
260
|
+
version: '${project.version}',
|
|
261
|
+
packaging: 'jar',
|
|
262
|
+
repositoryId: '${jar-release.repositoryId}',
|
|
263
|
+
url: '${jar-release.url}'
|
|
264
|
+
end
|
|
265
|
+
end
|
data/README.md
CHANGED
|
@@ -1,30 +1,29 @@
|
|
|
1
1
|
# JRuby-OpenSSL
|
|
2
2
|
|
|
3
|
-
[JRuby-OpenSSL](https://github.com/jruby/jruby-openssl) is an
|
|
4
|
-
[JRuby](https://www.jruby.org/) that emulates the Ruby OpenSSL native library.
|
|
3
|
+
[JRuby-OpenSSL](https://github.com/jruby/jruby-openssl) is an extension gem for
|
|
4
|
+
[JRuby](https://www.jruby.org/) that emulates the Ruby `OpenSSL` native library.
|
|
5
5
|
|
|
6
6
|
Under the hood it uses the [Bouncy Castle Crypto APIs](https://www.bouncycastle.org/java.html).
|
|
7
7
|
|
|
8
|
-
|
|
9
|
-
PKIX/CMS/EAC/PKCS/OCSP/TSP/OPENSSL jars), usually the latest available version.
|
|
8
|
+
All jruby-openssl gem releases include the Bouncy Castle library (BC Provider, BC JSSE
|
|
9
|
+
and PKIX/CMS/EAC/PKCS/OCSP/TSP/OPENSSL jars), usually the latest available version.
|
|
10
10
|
|
|
11
11
|
Please report bugs and incompatibilities (preferably with test-cases) to either
|
|
12
12
|
the JRuby [mailing list][1] or the [bug tracker][2].
|
|
13
13
|
|
|
14
14
|
## Compatibility
|
|
15
15
|
|
|
16
|
+
Check latest jruby-openssl gem spec's `jar` *requirements* for compatibility.
|
|
17
|
+
|
|
18
|
+
```ruby
|
|
19
|
+
require 'openssl'
|
|
20
|
+
JOpenSSL::VERSION
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
For older versions of the gem compatibility wasn't reported:
|
|
24
|
+
|
|
16
25
|
| JRuby-OpenSSL | JRuby compat | JVM compat | supported BC |
|
|
17
26
|
|---------------|:------------:|-----------:|-------------:|
|
|
18
|
-
| 0.9.6 | 1.6.8-9.0.2 | Java 6-8 | 1.47-1.50 |
|
|
19
|
-
| 0.9.12 | 1.6.8-9.0.5 | Java 6-8 | 1.47-1.52 |
|
|
20
|
-
| 0.9.13 | 1.6.8-9.1.2 | Java 6-8 | 1.49-1.52 |
|
|
21
|
-
| 0.9.14 | 1.6.8-9.1.5 | Java 6-8 | 1.49-1.54 |
|
|
22
|
-
| 0.9.17 | 1.6.8-9.1.5 | Java 6-8 | 1.50-1.54 |
|
|
23
|
-
| ~>0.9.18 | 1.6.8-9.1.x | Java 6-8 | 1.50-1.55 |
|
|
24
|
-
| 0.10.0 | 1.7.20-9.2.x | Java 7-10 | 1.55-1.59 |
|
|
25
|
-
| 0.10.3 | 1.7.20-9.2.x | Java 7-11 | 1.56-1.62 |
|
|
26
|
-
| ~>0.10.5 | 1.7.20-9.3.x | Java 7-11 | 1.60-1.68 |
|
|
27
|
-
| ~>0.11.x | 9.0.x-9.3.x | Java 7-11 | 1.62-1.68 |
|
|
28
27
|
| ~>0.12.x | 9.1.x-9.3.x | Java 8-15 | 1.65-1.68 |
|
|
29
28
|
| ~>0.13.x | 9.1.x-9.4.x | Java 8-17 | 1.68-1.69 |
|
|
30
29
|
| ~>0.14.x | 9.1.x-9.4.x | Java 8-21 | 1.71-1.74 |
|
|
@@ -39,30 +38,103 @@ JRuby-OpenSSL is an essential part of [JRuby](https://www.jruby.org/), please re
|
|
|
39
38
|
Please note that most OpenSSL vulnerabilities do not affect JRuby since it's not using
|
|
40
39
|
any of OpenSSL's C code, only Ruby parts (*.rb) are the same as in MRI's OpenSSL library.
|
|
41
40
|
|
|
42
|
-
##
|
|
41
|
+
## Supported configuration
|
|
42
|
+
|
|
43
|
+
Most runtime knobs are Java system properties.
|
|
44
|
+
Under JRuby you pass them as `-J-D...` flags, e.g. `JRUBY_OPTS='-J-Djruby.openssl.debug=true'`.
|
|
45
|
+
|
|
46
|
+
### Runtime / JVM properties
|
|
47
|
+
|
|
48
|
+
| Property | Default | Effect |
|
|
49
|
+
|----------|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
50
|
+
| `jruby.openssl.load.jars` | `true` | If set to `false`, `lib/jopenssl/load.rb` skips auto-loading the bundled BouncyCastle jars - handy when the BC jars are on the JVM classpath. |
|
|
51
|
+
| `jruby.openssl.debug` | `false` | Turns on internal debug logging and stack traces from the Java extension, has the same effect as setting `OpenSSL.debug = true` at runtime. |
|
|
52
|
+
| `jruby.openssl.warn` | follows JRuby's warning mode (`runtime.warningsEnabled()`) | Enables or disables warnings from the extension, set `false` to stay quiet regardless of `-w`. |
|
|
53
|
+
| `jruby.openssl.log.logger` | default stdout/stderr logger | Selects the internal logger implementation, set to `JUL` to route logs through `java.util.logging`. |
|
|
54
|
+
| `jruby.openssl.log.silence` | `true` | Silences a few noisy BC / BC-JSSE loggers by default, set `false` to leave their levels untouched. |
|
|
55
|
+
| `jruby.openssl.provider.ssl` | `BCJSSE` | Selects the SSL provider. `BCJSSE`, `BC`, or `true` all mean BC-JSSE, an empty string or `false` falls back to the platform JSSE provider. |
|
|
56
|
+
| `jruby.openssl.ssl.error_wait_nonblock.backtrace` | falls back to `jruby.errno.backtrace` (which defaults to `false`) | Whether `SSLErrorWaitReadable` / `SSLErrorWaitWritable` carry backtraces. |
|
|
57
|
+
| `jruby.openssl.x509.lookup.cache` | disabled | Caching for X.509 lookup results. `true` turns on a soft cache; an integer such as `8` gives a bounded strong/soft cache of that size, unset or `false` disables it. |
|
|
58
|
+
|
|
59
|
+
### Environment variables
|
|
60
|
+
|
|
61
|
+
| Variable | Default | Effect |
|
|
62
|
+
|----------|---------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
63
|
+
| `SSL_CERT_FILE` | platform / packaged default CA file | Overrides the default certificate bundle used for X.509 default-path loading, `.crt`, `.cer`, or `.pem` are read as a PEM bundle, otherwise treated as a Java CA store path. |
|
|
64
|
+
| `SSL_CERT_DIR` | platform / packaged default CA directory | Overrides the default certificate directory list for X.509 default-path loading, separate multiple directories with the platform path separator. |
|
|
65
|
+
| `OPENSSL_ALLOW_PROXY_CERTS` | unset / disabled | When set to anything other than `false`, proxy certificates are allowed during certificate chain validation. |
|
|
66
|
+
|
|
67
|
+
### Other supported customizations
|
|
68
|
+
|
|
69
|
+
- `OpenSSL.debug = true` gives you the same internal debug logging as `-Djruby.openssl.debug=true`
|
|
70
|
+
- when `jruby.openssl.warn` is unset, JRuby's own warning mode (`ruby -w`) decides whether warnings show
|
|
71
|
+
- `OpenSSL::Config` can look up variables from the process environment through the `ENV` section, matching the upstream Ruby OpenSSL config parser
|
|
72
|
+
|
|
73
|
+
|
|
74
|
+
## Differences from OpenSSL
|
|
75
|
+
|
|
76
|
+
JRuby-OpenSSL aims to be a source-compatible drop-in for MRI's `openssl` - same Ruby API and
|
|
77
|
+
same `require 'openssl'`. But there are limitations on the JVM (with JCE and JSSE) as well as
|
|
78
|
+
Bouncy Castle libraries, so some entry points are unavailable, behave differently, or are no-ops.
|
|
79
|
+
|
|
80
|
+
**Engine**
|
|
81
|
+
- `OpenSSL::Engine` is not implemented - there is no hardware/engine layer, `OpenSSL::Engine.*`
|
|
82
|
+
raises `NameError` (uninitialized constant)
|
|
83
|
+
|
|
84
|
+
**SSL / TLS** (backed by JSSE)
|
|
85
|
+
- `SSLSocket#state` and NPN (`#npn_protocol`) are unimplemented and return `nil` - use ALPN instead
|
|
86
|
+
- Forced session resumption (`SSLSocket#session=`) is best-effort and only fully works with the
|
|
87
|
+
BouncyCastle JSSE provider; `session_reused?` may return `nil` ("can't decide")
|
|
88
|
+
- `SSL::Session#id=` / `#time=` are no-ops; `SSL::Session.new` on a non-socket raises `NotImplementedError`
|
|
89
|
+
- Hostname / `subjectAltName` matching runs over Java's certificate parsing and can differ from
|
|
90
|
+
MRI's `GeneralName` handling in edge cases
|
|
91
|
+
|
|
92
|
+
**Cipher** (JCE / Bouncy Castle)
|
|
93
|
+
- The available cipher set is provider-dependent (what JCE/BC offer on your JVM), not the fixed
|
|
94
|
+
libcrypto list (some OpenSSL ciphers may be missing or vary by JDK)
|
|
95
|
+
- CFB1 mode (`*-cfb1`) is excluded (doesn't match OpenSSL under BC)
|
|
96
|
+
- AEAD is limited to what JCE exposes; `iv_len=` on a non-AEAD cipher raises
|
|
43
97
|
|
|
44
|
-
|
|
45
|
-
|
|
98
|
+
**PKey** (EC / DH / EdDSA)
|
|
99
|
+
- EC is limited to prime curves (`:GFp`); binary-field curves (`:GF2m`) fail
|
|
100
|
+
- `EC::Point#mul` with array arguments, `:hybrid` point compression, and encrypted EC private-key
|
|
101
|
+
export are not implemented
|
|
102
|
+
- `DH#set_pqg` accepts but silently ignores the `q` parameter
|
|
103
|
+
- EdDSA (`Ed25519` / `Ed448`) rejects digest arguments
|
|
46
104
|
|
|
47
|
-
|
|
48
|
-
|
|
105
|
+
**X509**
|
|
106
|
+
- multi-valued RDNs (the `+` separator in a DN string) are not supported and raise `X509::NameError`.
|
|
107
|
+
- few `authorityKeyIdentifier` extension configurations are unsupported
|
|
49
108
|
|
|
50
|
-
|
|
109
|
+
**Random**
|
|
110
|
+
- randomness comes from the JVM's `SecureRandom`; the EGD and seed-file APIs (`Random.egd`,
|
|
111
|
+
`egd_bytes`, `load_random_file`, `write_random_file`) are no-ops
|
|
51
112
|
|
|
52
|
-
|
|
53
|
-
|
|
113
|
+
**Other**
|
|
114
|
+
- `OpenSSL.fips_mode = true` raises `NotImplementedError` unless the separate [FIPS variant](#fips)
|
|
115
|
+
gem is installed
|
|
116
|
+
- some rarely-used entry points are no-ops (`OpenSSL.check_func`, `deprecated_warning_flag`) and
|
|
117
|
+
`OPENSSL_NO_SOCK` is `nil` rather than a boolean
|
|
118
|
+
- a few PKCS7 content types can't be reconstructed purely from ASN.1 (may surface when parsing
|
|
119
|
+
some S/MIME structures)
|
|
54
120
|
|
|
55
|
-
|
|
121
|
+
Hitting something not listed here that MRI's OpenSSL supports?
|
|
122
|
+
Please report it on the [bug tracker][2], ideally with a test case.
|
|
56
123
|
|
|
57
|
-
|
|
124
|
+
## FIPS
|
|
58
125
|
|
|
59
|
-
|
|
126
|
+
A FIPS 140-3 build of jruby-openssl is available as a separate gem.
|
|
127
|
+
It's the very same library but uses the NIST-validated BC FIPS module (BC-FJA) instead of
|
|
128
|
+
regular Bouncy Castle, for deployments that need a validated cryptographic module.
|
|
129
|
+
Ships separately under GPL 3.0, with commercial licensing available - see the
|
|
130
|
+
[FIPS variant][6] wiki page for details.
|
|
60
131
|
|
|
61
|
-
NOTE:
|
|
132
|
+
NOTE: unlike C OpenSSL, `OpenSSL.fips_mode` cannot be changed at runtime, the flag reports
|
|
133
|
+
which gem variant is activated (`true` under the FIPS gem, `false` otherwise).
|
|
62
134
|
|
|
63
135
|
## License
|
|
64
136
|
|
|
65
|
-
(c) 2009-2026 JRuby distributed under EPL 1.0/GPL 2.0/LGPL 2.1
|
|
137
|
+
(c) 2009-2026 JRuby distributed under EPL 1.0 / GPL 2.0 / LGPL 2.1
|
|
66
138
|
|
|
67
139
|
[0]: https://github.com/jruby/jruby-openssl/security
|
|
68
140
|
[1]: https://github.com/jruby/jruby/wiki/MailingLists
|
|
@@ -70,3 +142,4 @@ NOTE: you can pick any JRuby version which is on [Maven Central][4] or on [ci.jr
|
|
|
70
142
|
[3]: https://github.com/jruby/jruby-openssl/tree/master/integration
|
|
71
143
|
[4]: https://repo1.maven.org/maven2/org/jruby/
|
|
72
144
|
[5]: https://www.jruby.org/nightly
|
|
145
|
+
[6]: https://github.com/jruby/jruby-openssl/wiki/FIPS
|