jruby-openssl 0.16.2-java → 0.19.1-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f4ee516b3ef8e6244b038e411f6ffd2ab3636354436cbd35dda721cd5fe8ce26
-  data.tar.gz: 4eaea6e9b394b2531f0f1f77560f8e25e26fe8875a4077a23fdd98b0a4e1d280
+  metadata.gz: d303c479c506753df7b876af7963e7eea17311aff21f7830deab8fb406a99e85
+  data.tar.gz: 24f04a2d978a80711b6271e748068037ad8b4ce4b0f2607ba57aab283c7d980d
 SHA512:
-  metadata.gz: e022537b9d08c6ba9780b1690b11b0feac7d6bee39b250f733f422cba4a08c32738ef0ff8bb08e549254a11b5d8920a1b97feef913ed13e3b1f0a051bd7266b4
-  data.tar.gz: '0335588f3399b8d039b68ab534c60e2af850ab7f04e2e4cf96e4ef85e8d9ef24f3f4f687e7a392d148c82cc2704c0788081825220fb664df522c1c99cc754fa2'
+  metadata.gz: 43e9318c7276016bec340d935b6e78b019c6a1959cbed2c5b0f2545617618b84e6da586d83291a5dd55d9609d2534fe051228a8af99104e8e96d85054c53e025
+  data.tar.gz: caabdffeedc0fc4a813be83222cceddfc85d254959f32a81ad9b908a84a3feec977b67628484b7af72f30cbbc3469c44287934d8a0945d8782e147e2dee4e0d7

data/History.md

@@ -1,3 +1,150 @@
+## 0.19.1
+
+X25519/X448 key support and DH key reading, and a (final) round of provider 
+routing driven by the FIPS variant
+
+- [feat] X25519/X448 type `PKey` support
+  `PKey.read`, `generate_key` and `new_raw_private/public_key` now handle XDH
+- [feat] read DH keys (not just DH parameters)
+  PKCS#8 and SubjectPublicKeyInfo DH keys previously failed to parse
+- [compat] read DH parameters via `OpenSSL::PKey.read`
+- [compat] ASN.1 objects for the RFC 8410 curves
+  `ASN1::ObjectId` could not resolve X25519/X448/ED25519/ED448 by name or OID
+- [compat] `PKey#inspect` reporting `oid` and `type_name`
+- [compat] define `OP_NO_RENEGOTIATION` constant
+- [fix] read back DER written by `PKey#to_der`
+  `PKey.read` only tried PKCS#8 on DER input
+- [fix] raise `PKeyError` for unsupported public key algorithm
+- [fix] raise `SSLError` on handshake failure in connect (#204)
+  JSSE may abort handshake with a plain exception when no protocol is enabled
+- [compat] read and write PKCS12 through Bouncy Castle
+  supports OpenSSL 3 PBES2/PBKDF2 encryption and PBMAC1 MACs without JDK KeyStore
+- [compat] honor `PKCS12.create` PBE and iteration arguments
+  regular mode writes requested legacy PBE algorithms (FIPS rejects unapproved)
+- [feat] honor configured Java trust store properties
+  load explicit `javax.net.ssl.trustStore` using the configured `trustStoreType`,
+  `trustStoreProvider` and `trustStorePassword`
+- [deps] bump bcprov artifact to latest patch (1.85.2)
+
+### Provider Routing
+
+Operations that resolved through JDK security now go to the configured provider.
+
+- [fips] pin provider when signing certificates and CRLs
+- [fips] use provider when verifying certificates
+  `X509Certificate#verify(PublicKey)` goes to the JDK default and a certificate
+  read from a JKS keystore stays a `sun.security.x509.X509CertImpl`
+- [fips] generate DSA keys through provider
+  `generate_key!` derived private exponent by hand instead of asking for a key pair
+- [fips] keep cipher policy + OCSP digests on provider
+- [fips] report **fips_mode** based on approved-only
+  `OpenSSL.fips_mode` now reports whether FIPS is being *enforced*, as C does;
+  `OPENSSL_FIPS` reports whether the build is FIPS-*capable*
+
+## 0.19.0
+
+FIPS support, distributed as a **separate, dual GPL/commercial artifact**.
+
+Alongside FIPS, this release switches TLS to BouncyCastle's JSSE provider by
+default (session reuse, ChaCha20-Poly1305, session/servername callbacks), and
+lands an extensive X.509 verification hardening (name constraints, CRL scope, 
+path-length, partial-chain handling and improved hostname verification).
+
+NOTE: due considerable amount of changes please treat 0.19 as a beta release.
+
+- [feat] FIPS support as a separate `jruby-openssl` artifact bundling BC-FIPS
+- [feat] leverage BouncyCastle's JSSE provider by default for SSL/TLS
+- [build] restore binary compatibility with BC < 1.84
+- [feat] `to_java` conversions (`X500Principal`, `KeyPair`, `MessageDigest`, `Mac`)
+- [feat] pluggable internal logging via a logger interface
+- [feat] route logs through `java.util.logging` (`jruby.openssl.log.logger=jul`)
+- [chore] remove long-deprecated methods and legacy JRuby/JOpenSSL constants
+
+### SSL / TLS
+
+- [feat] proper TLS session reuse with the BC provider
+- [compat] add `SSLSession#to_der`, `#to_pem` and `#to_text`
+- [feat] (re)implement SSLContext session callbacks
+- [feat] start calling `servername_cb`
+- [feat] server-only `renegotiation_cb`
+- [feat] TLS 1.2 ChaCha20-Poly1305 cipher suites
+- [fix] `read_nonblock(exception: false)` throwing on TLS 1.3
+- [fix] SSL write data loss on non-blocking partial flush
+- [fix] keep TLS 1.3 with `ciphers=` and a default timeout
+- [fix] `SSLSocket#cipher` returns `[name, version, bits, alg_bits]`
+- [fix] raise on `sysread`/`syswrite` before handshake
+- [fix] `session_reused?` raises before handshake
+- [fix] close connection on hostname-verification failure
+- [compat] emulate early `verify_hostname` during `SSLSocket#connect`
+- [compat] normalize IP address in SAN verify to match MRI
+- [compat] `undef` `SSLContext#dup`/`clone` and reject option writers
+- [compat] `set_params` must OR options (not overwrite them)
+- [fix] serialize concurrent SSL reads/writes to avoid buffer corruption
+- [fix] grow the application read buffer on TLS unwrap `BUFFER_OVERFLOW`
+- [compat] honor `verify_callback` on the `ca_file`/`ca_path` lookup path
+
+### X.509 / certificate verification
+
+- [compat] implement `nameConstraints` verification
+- [fix] properly encode `nameConstraints` extension
+- [compat] enforce dNSName name constraints against EE subject CN
+- [compat] enforce CRL issuing-distribution-point scope
+- [fix] align `cert_crl` critical-extension and `removeFromCRL` handling
+- [fix] proper path-length constraint on self-signed roots
+- [fix] make `V_FLAG_PARTIAL_CHAIN` verify correctly
+- [fix] canonicalize X.509 name before hashed-dir lookup
+- [fix] `StoreContext#getExtraData` IndexOutOfBoundsException
+- [fix] cert time checks when not-before/after are equal
+- [compat] `StoreContext#verify` raises on internal error
+- [compat] implement `Store#add_path` for cert lookup
+- [compat] `verify_result` reporting with `VERIFY_NONE` (#25)
+- [compat] set `V_ERR_HOSTNAME_MISMATCH` on hostname fail
+- [compat] expose missing `V_ERR`/`V_FLAG` constants to Ruby
+- [compat] keep X.509 extension order for certs
+- [fix] don't clobber shared (store) verify settings
+- [compat] drop `V_FLAG_CRL_CHECK_ALL` on `DEFAULT_CERT_STORE`
+- [fix] report a malformed `subjectAltName` as an invalid extension
+- [fix] avoid false revocation from `certificateIssuer` CRL entries
+- [fix] proper escaping in `X509::Name`
+- [fix] ASCII-only X.509 name canonicalization
+- [compat] align `X509::StoreContext` state exposure
+- [fix] `subjectAltName` with an `otherName` entry breaking hostname verification (#324)
+- [fix] format the `nameConstraints` extension value like OpenSSL does
+
+### PKey / Cipher / ASN.1
+
+- [feat] AES-CCM cipher mode support (#96)
+- [feat] implement `OpenSSL::PKey::EC::Point#invert!`
+- [compat] `PKey.generate_key`/`generate_parameters` (with params/String)
+- [compat] support HMAC key with the generic PKey API
+- [compat] implement `PKey::EC#check_key` validation
+- [compat] support `PKey::EC.new` with 4 args
+- [fix] RSA-PSS reject negative salt and align `sign_pss` default
+- [fix] handle mismatched PSS content/MGF1 digests via fallback
+- [fix] `Cipher#key=` rejects any length mismatch
+- [fix] reject over-length IV for AEAD ciphers
+- [compat] align `Cipher#iv=` and AEAD-only writers
+- [fix] manual block cipher (buffer/padding) edge cases under CBC/ECB
+- [compat] match MRI no-salt cipher derivation
+- [compat] derive cipher IV length from the real block size
+- [fix] PBKDF2 raw password bytes and reject `< 0` iterations
+- [compat] OpenSSL default PBKDF2 iterations for key export
+- [fix] bound ASN.1 nesting depth and fix truncated-input error class
+- [fix] add missing ASN.1 object-ids for SHA-2
+- [compat] switch `BN.pseudo_rand` to secure random
+- [compat] allow CRT parameter setters on RSA
+- [fix] Cipher authentication-tag reset behavior
+- [fix] break `OpenSSL::Config` `.include` reference cycles
+
+### PKCS7 / PKCS12 / OCSP
+
+- [feat] implement missing PKCS7 wrapper methods
+- [feat] implement `X509::Request#to_text`
+- [fix] protect PKCS12 key entries with password
+- [fix] wrap mode for PKCS7 key transport
+- [compat] handle `File` object in `PKCS7.obj2bio`
+- [fix] preserve OCSP `NOCERTS` with explicit flags
+
 ## 0.16.2
 
 - [fix] PKey.generate_key accepts key as parameters (#366)

data/Mavenfile

@@ -1,125 +1,122 @@
 #-*- mode: ruby -*-
 
-gemspec :jar => 'jopenssl', :include_jars => true
+load File.expand_path('lib/jopenssl/version.rb', File.dirname(__FILE__))
+
+gemspec jar: 'jopenssl'
+# gemspec defaults to 'rubygems' groupId
+# `id` resets the version, so pass full GAV (gem 0.20.0.dev -> Maven -SNAPSHOT)
+maven_version = JOpenSSL::VERSION
+maven_version += "-SNAPSHOT" if JOpenSSL::VERSION.match?(/[a-zA-Z]/)
+id "org.jruby.openssl:jruby-openssl:#{maven_version}"
 
 distribution_management do
-  snapshot_repository :id => :ossrh, :url => 'https://oss.sonatype.org/content/repositories/snapshots'
-  repository :id => :ossrh, :url => 'https://oss.sonatype.org/service/local/staging/deploy/maven2/'
+  snapshot_repository id: :ossrh, url: 'https://oss.sonatype.org/content/repositories/snapshots'
+  repository id: :ossrh, url: 'https://oss.sonatype.org/service/local/staging/deploy/maven2/'
 end
 
 java_target = '1.8'
 gen_sources = '${basedir}/target/generated-sources' # hard-coded in AnnotationBinder
 
-plugin( 'org.codehaus.mojo:exec-maven-plugin', '3.5.0' ) do
-
-=begin
-  invoker_main  = '-Djruby.bytecode.version=${compiler.target}'
-  #invoker_main << ' -classpath '
-  invoker_main << ' org.jruby.anno.InvokerGenerator'
-  invoker_main << " #{gen_sources}/annotated_classes.txt ${project.build.outputDirectory}"
-
-  dependency 'org.jruby', 'jruby-core', '${jruby.version}'
-
-  execute_goal :java, :id => 'invoker-generator', :phase => 'process-classes',
-      :mainClass => 'org.jruby.anno.InvokerGenerator', :classpathScope => 'compile',
-      #:arguments => [ '${gen.sources}/annotated_classes.txt', '${project.build.outputDirectory}' ] do
-      :commandlineArgs => "#{gen_sources}/annotated_classes.txt ${project.build.outputDirectory}",
-      :classpathScope => 'runtime', :additionalClasspathElements => [ '${project.build.outputDirectory}' ],
-      :includeProjectDependencies => false, :includePluginDependencies => true do
-
-    #systemProperties do
-    #  property '-Djruby.bytecode.version=${compiler.target}'
-    #end
-=end
-
-  execute_goal :exec, :id => 'invoker-generator', :phase => 'process-classes',
-      :executable => 'java', :classpathScope => 'compile',
-      :arguments => [ "-Djruby.bytecode.version=#{java_target}",
+plugin 'org.codehaus.mojo:exec-maven-plugin', '3.5.0' do
+  execute_goal :exec, id: 'invoker-generator', phase: 'process-classes',
+      executable: 'java', classpathScope: 'compile',
+      arguments: [ "-Djruby.bytecode.version=#{java_target}",
                       '-classpath', xml( '<classpath/>' ),
                       'org.jruby.anno.InvokerGenerator',
                       "#{gen_sources}/annotated_classes.txt",
                       '${project.build.outputDirectory}' ]
+
+  # inlines the shim call sites straight into the compiled classes
+  execute_goal :exec, id: 'shim-inliner', phase: 'process-classes',
+      executable: 'java', classpathScope: 'compile',
+      skip: '${shim.inline.skip}', # -Dshim.inline.skip=true to bypass
+      arguments: [ '-classpath', xml( '<classpath/>' ),
+                      '${basedir}/src/build/java/ShimInliner.java',
+                      '${project.build.outputDirectory}' ]
 end
 
-plugin( 'org.codehaus.mojo:build-helper-maven-plugin', '3.6.1' ) do
-  execute_goal 'add-source', :phase => 'process-classes', :sources => [ gen_sources ]
+plugin 'org.codehaus.mojo:build-helper-maven-plugin', '3.6.1' do
+  execute_goal 'add-source', phase: 'process-classes', sources: [ gen_sources ]
+end
+
+# building needs JDK 11+ (module-info + the ShimInliner source launcher)
+plugin :enforcer, '3.5.0' do
+  execute_goal 'enforce', id: 'enforce-java-version',
+               rules: { requireJavaVersion: { version: '[11,)' } }
 end
 
 compiler_configuration = {
-    :source => '1.8', :target => java_target, :release => '8',
-    :encoding => 'UTF-8', :debug => true,
-    :showWarnings => true, :showDeprecation => true,
-    :excludes => [ 'module-info.java' ],
-    #:jdkToolchain => { :version => '[1.7,11)' },
-    :generatedSourcesDirectory => gen_sources,
-    :annotationProcessors => [ 'org.jruby.anno.AnnotationBinder' ]
+    source: '1.8', target: java_target, release: '8',
+    encoding: 'UTF-8', debug: true,
+    showWarnings: true, showDeprecation: true,
+    excludes: [ 'module-info.java' ],
+    #jdkToolchain: { version: '[1.7,11)' },
+    generatedSourcesDirectory: gen_sources,
+    annotationProcessors: [ 'org.jruby.anno.AnnotationBinder' ]
 }
-compiler_configuration.delete(:release) if ENV_JAVA['java.specification.version'] == '1.8'
-
-plugin( :compiler, '3.15.0', compiler_configuration) do
-
-  #execute_goal :compile, :id => 'annotation-binder', :phase => 'compile',
-  #    :generatedSourcesDirectory => gen_sources, #:outputDirectory => gen_sources,
-  #    :annotationProcessors => [ 'org.jruby.anno.AnnotationBinder' ],
-  #    :proc => 'only', # :compilerReuseStrategy => 'alwaysNew',
-  #    :useIncrementalCompilation => false, :fork => true, :verbose => true,
-  #    :compilerArgs => [ '-XDignore.symbol.file=true', '-J-Dfile.encoding=UTF-8' ]
 
+plugin :compiler, '3.15.0', compiler_configuration do
   execute_goal :compile,
-               :id => 'compile-populators', :phase => 'process-classes',
-               :includes => [ 'org/jruby/gen/**/*.java' ],
-               :optimize => true,
-               :compilerArgs => [ '', '-XDignore.symbol.file=true' ]
+               id: 'compile-populators', phase: 'process-classes',
+               includes: [ 'org/jruby/gen/**/*.java' ],
+               optimize: true,
+               compilerArgs: [ '', '-XDignore.symbol.file=true' ]
 end
 
-plugin :clean do
-  execute_goals( 'clean', :id => 'default-clean', :phase => 'clean',
-                 'filesets' => [
-                    { :directory => 'lib', :includes => [ 'jopenssl.jar' ] },
-                    { :directory => 'lib/org' },
-                    { :directory => 'target', :includes => [ '*' ] }
-                 ],
-                 'failOnError' =>  'false' )
-end
+plugin! :jar, '3.4.1',
+        'outputDirectory' => 'lib', 'finalName' => 'jopenssl',
+        'excludes' => [ 'annotated_classes.txt' ],
+        'archive' => { 'manifestEntries' => { 'JOpenSSL-Variant' => 'main' } }
+
+plugin! :clean, '2.4',
+        'filesets' => [
+          { directory: 'lib', includes: [ 'jopenssl.jar' ] },
+          { directory: 'vendor' },
+          { directory: 'target', includes: [ '*' ] }
+        ],
+        'failOnError' => 'false'
 
 jruby_compile_compat = '9.2.1.0'
-jar 'org.jruby:jruby-core', jruby_compile_compat, :scope => :provided
+jar 'org.jruby:jruby-core', jruby_compile_compat, scope: :provided
+jar 'org.ow2.asm:asm-analysis', '9.8', scope: :provided # build-time only (for ShimInliner)
 # for invoker generated classes we need to add javax.annotation when on Java > 8
-jar 'javax.annotation:javax.annotation-api', '1.3.1', :scope => :compile
-jar 'org.junit.jupiter:junit-jupiter', '5.11.4', :scope => :test
+jar 'javax.annotation:javax.annotation-api', '1.3.1', scope: :compile
+jar 'org.junit.jupiter:junit-jupiter', '5.11.4', scope: :test
 # a test dependency to provide digest and other stdlib bits, needed when loading OpenSSL in Java unit tests
-jar 'org.jruby:jruby-stdlib', jruby_compile_compat, :scope => :test
+jar 'org.jruby:jruby-stdlib', jruby_compile_compat, scope: :test
 
 plugin :surefire, '3.5.5'
 
-# NOTE: to build on Java 11 - installing gems fails (due old jossl) with:
-#  load error: jopenssl/load -- java.lang.StringIndexOutOfBoundsException
-MVN_JRUBY_VERSION = '9.2.19.0'
+MVN_JRUBY_VERSION = '9.4.14.0'
 
 jruby_plugin! :gem do
   # when installing dependent gems we want to use the built in openssl not the one from this lib directory
-  execute_goal :id => 'default-package', :addProjectClasspath => false, :libDirectory => 'something-which-does-not-exists'
-  execute_goals :id => 'default-push', :skip => true
+  execute_goal id: 'default-package', addProjectClasspath: false, libDirectory: 'something-which-does-not-exists'
+  execute_goals id: 'default-push', skip: true
 end
 
 # we want to have the snapshots on oss.sonatype.org and the released gems on maven central
 plugin :deploy, '3.1.4' do
-  execute_goals( :deploy, :skip => false )
+  # gem.deploy.skip is flipped on by the jar-release profile (jar-only deploy)
+  execute_goals( :deploy, skip: '${gem.deploy.skip}' )
 end
 
-supported_bc_versions = %w{ 1.78 1.79 1.80 1.81 1.82 1.83 1.84 1.85 }
+supported_bc_versions = %w{ 1.80 1.81 1.82 1.83 1.84 1.85 }
 
 default_bc_version = File.read File.expand_path('lib/jopenssl/version.rb', File.dirname(__FILE__))
 default_bc_version = default_bc_version[/BOUNCY_CASTLE_VERSION\s?=\s?'(.*?)'/, 1]
 
-properties( 'jruby.plugins.version' => '3.0.6',
+# reproducible builds: Rakefile passes -Dproject.build.outputTimestamp=$SOURCE_DATE_EPOCH
+properties( 'shim.inline.skip' => 'false',
+            'gem.deploy.skip' => 'false', # jar-release profile sets this true
+            'jruby.plugins.version' => '3.0.6',
             'jruby.switches' => '-W0', # https://github.com/torquebox/jruby-maven-plugins/issues/94
             'bc.versions' => default_bc_version,
             'invoker.test' => '${bc.versions}',
             # allow to skip all tests with -Dmaven.test.skip
             'invoker.skip' => '${maven.test.skip}',
             'skipRunit' => 'true',
-            'runit.dir' => 'src/test/ruby/**/test_*.rb',
+            'runit.dir' => 'test/**/test_*.rb',
             'mavengem.wagon.version' => '2.0.2', # for jruby plugin
             'mavengem-wagon.version' => '3.0.0', # for polyglot-ruby
             # use this version of jruby for the jruby-maven-plugins
@@ -127,26 +124,22 @@ properties( 'jruby.plugins.version' => '3.0.6',
             # dump pom.xml when running 'rmvn'
             'polyglot.dump.pom' => 'pom.xml', 'polyglot.dump.readonly' => false )
 
-# make sure we have the embedded jars in place before we run runit plugin
 plugin! :dependency do
   execute_goal 'copy-dependencies',
-               :phase => 'generate-test-resources',
-               :outputDirectory => '${basedir}/lib',
-               :useRepositoryLayout => true,
-               :includeGroupIds => 'org.bouncycastle'
+               phase: 'generate-test-resources',
+               outputDirectory: '${basedir}/vendor',
+               useRepositoryLayout: true,
+               includeGroupIds: 'org.bouncycastle'
 end
 
-jruby_plugin(:runit) { execute_goal( :test, :runitDirectory => '${runit.dir}' ) }
-
 invoker_run_options = {
-    :id => 'tests-with-different-bc-versions',
-    :projectsDirectory => 'integration',
-    :pomIncludes => [ '*/pom.xml' ],
-    :streamLogs => true,
+    id: 'tests-with-different-bc-versions',
+    projectsDirectory: 'src/it',
+    pomIncludes: [ '*/pom.xml' ],
+    streamLogs: true,
     # pass those properties on to the test project
-    :properties => {
+    properties: {
       'jruby.versions' => '${jruby.versions}',
-      'jruby.modes' => '${jruby.modes}',
       'jruby.openssl.version' => '${project.version}',
       'bc.versions' => '${bc.versions}',
       'runit.dir' => '${runit.dir}' }
@@ -155,13 +148,13 @@ invoker_run_options = {
 jruby_versions = []
 jruby_versions += %w{ 9.2.19.0 9.2.20.1 }
 jruby_versions += %w{ 9.3.3.0 9.3.13.0 }
-jruby_versions += %w{ 9.4.8.0 9.4.14.0 }
-jruby_versions += %w{ 10.0.2.0 }
+jruby_versions += %w{ 9.4.8.0 9.4.14.0 9.4.15.0 9.4.16.0 }
+jruby_versions += %w{ 10.0.1.0 10.0.3.0 10.0.5.0 10.0.6.0 }
 
 jruby_versions.each do |version|
-  profile :id => "test-#{version}" do
+  profile id: "test-#{version}" do
     plugin :invoker, '3.8.1' do
-      execute_goals( :install, :run, invoker_run_options )
+      execute_goals :install, :run, invoker_run_options
     end
     properties 'jruby.version' => version,
                'jruby.versions' => version,
@@ -169,10 +162,104 @@ jruby_versions.each do |version|
   end
 end
 
-profile :id => 'release' do
+profile id: 'release' do
   plugin :gpg, '3.1.0' do
-    execute_goal :sign, :phase => :verify
+    execute_goal :sign, phase: :verify
   end
 end
 
-# vim: syntax=Ruby
+# packages everything (lib/ included) into a self-contained jruby-openssl.jar
+# and deploys it as a plain (non-gem) Maven artifact under org.jruby.openssl
+profile id: 'jar-release' do
+  jar_release_dir = '${project.build.directory}/jar-release'
+  jar_release_src_dir = '${project.build.directory}/jar-release-sources'
+  jar_release_modpath = '${project.build.directory}/jar-release-modpath'
+  jar_release_file = '${project.build.directory}/${project.build.finalName}.jar'
+  jar_release_sources = '${project.build.directory}/${project.build.finalName}-sources.jar'
+
+  # ship only what is committed, the same way the gemspec picks its (lib) files
+  jar_release_rb = `git ls-files lib`.split("\n").select { |f| f.end_with?('.rb') }
+  raise 'no lib/**/*.rb tracked by git - cannot assemble the jar-release' if jar_release_rb.empty?
+  jar_release_rb = jar_release_rb.map { |f| f.sub(%r{\Alib/}, '') } # relative to lib directory
+
+  # same rule for the sources jar - explicit list of committed .java files
+  jar_release_src = `git ls-files src/main/java`.split("\n").select { |f| f.end_with?('.java') }
+  raise 'no src/main/java/**/*.java tracked by git - cannot assemble the jar-release' if jar_release_src.empty?
+  jar_release_src = jar_release_src.map { |f| f.sub(%r{\Asrc/main/java/}, '') } # relative to directory
+
+  properties 'gem.deploy.skip' => 'true', # publish only the jar, not the gem
+             'jar-release.repositoryId' => 'ossrh',
+             # release staging by default; override with the snapshots url for SNAPSHOT versions
+             'jar-release.url' => 'https://oss.sonatype.org/service/local/staging/deploy/maven2/'
+
+  plugin :resources, '3.3.1' do
+    execute_goal 'copy-resources', id: 'jar-release-classes', phase: 'prepare-package',
+        outputDirectory: jar_release_dir,
+        resources: [ { directory: '${project.build.outputDirectory}' } ]
+    execute_goal 'copy-resources', id: 'jar-release-lib', phase: 'prepare-package',
+        outputDirectory: jar_release_dir,
+        resources: [ { directory: 'lib', includes: jar_release_rb } ]
+    # NOTE: maven-source-plugin refuses to run on a gem-packaged project
+    execute_goal 'copy-resources', id: 'jar-release-sources', phase: 'prepare-package',
+        outputDirectory: jar_release_src_dir,
+        resources: [ { directory: 'src/main/java', includes: jar_release_src } ]
+    # the lib/*.rb ships in the sources jar too, same as in the jar-release .jar
+    execute_goal 'copy-resources', id: 'jar-release-sources-lib', phase: 'prepare-package',
+        outputDirectory: jar_release_src_dir,
+        resources: [ { directory: 'lib', includes: jar_release_rb } ]
+    # the module descriptor source ships in the sources jar as well
+    execute_goal 'copy-resources', id: 'jar-release-sources-module', phase: 'prepare-package',
+        outputDirectory: jar_release_src_dir,
+        resources: [ { directory: 'src/main/module', includes: [ 'module-info.java' ] } ]
+  end
+
+  # a module path for compiling module-info;
+  # the full classpath cannot be used as-is (jnr-* jars split jnr.enxio.channels)
+  # main sources compile against the 9.2 compat jruby-core (module 'org.jruby'),
+  # but the descriptor requires 'org.jruby.dist' - runtime name since 9.4.13
+  plugin! :dependency do
+    execute_goal 'copy-dependencies', id: 'jar-release-modpath-bc', phase: 'generate-resources',
+        outputDirectory: jar_release_modpath,
+        includeGroupIds: 'org.bouncycastle'
+    execute_goal 'copy', id: 'jar-release-modpath-jruby', phase: 'generate-resources',
+        outputDirectory: jar_release_modpath,
+        artifactItems: [ { groupId: 'org.jruby', artifactId: 'jruby-core', version: MVN_JRUBY_VERSION } ]
+  end
+
+  # module-info targets Java 9 bytecode, so compiled separately from the Java 8
+  # main sources; patched onto the already compiled classes dir
+  plugin 'org.codehaus.mojo:exec-maven-plugin' do
+    execute_goal :exec, id: 'jar-release-module-info', phase: 'process-classes',
+        executable: 'javac',
+        arguments: [ '--release', '9',
+                     '--module-path', jar_release_modpath,
+                     '--patch-module', 'org.jruby.ext.openssl=${project.build.outputDirectory}',
+                     '-d', jar_release_dir,
+                     '${basedir}/src/main/module/module-info.java' ]
+  end
+
+  plugin :jar, '3.4.1' do
+    execute_goal :jar, id: 'jar-release', phase: 'package',
+        classesDirectory: jar_release_dir,
+        outputDirectory: '${project.build.directory}',
+        finalName: '${project.build.finalName}'
+
+    execute_goal :jar, id: 'jar-release-sources', phase: 'package',
+        classesDirectory: jar_release_src_dir,
+        outputDirectory: '${project.build.directory}',
+        finalName: '${project.build.finalName}',
+        classifier: 'sources'
+  end
+
+  plugin :deploy, '3.1.4' do
+    execute_goal 'deploy-file', id: 'jar-release-deploy', phase: 'deploy',
+        file: jar_release_file,
+        sources: jar_release_sources,
+        groupId: '${project.groupId}',
+        artifactId: '${project.artifactId}',
+        version: '${project.version}',
+        packaging: 'jar',
+        repositoryId: '${jar-release.repositoryId}',
+        url: '${jar-release.url}'
+  end
+end