jruby-openssl 0.19.0-java → 0.19.2-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e2a2b1fb32208ee3d9a8d7d396c254a3abf7a2663cce26bafda818c8306964d4
-  data.tar.gz: 7047f2d22daf89569aa1a100572dedcd637247a6bb3b5a95899a70d7726bfc72
+  metadata.gz: 333ea31e2b8e97fe3952c679a5c7e4518d5044bb4022015db9307481ee1a8bb8
+  data.tar.gz: 7439667603e352d2158e3778e9060664c94e529cb2c205578613169b7cea45e8
 SHA512:
-  metadata.gz: eb37c06db9d13bf09b02868f778869b7cb0d71fc6c22b216099348824f67b387aaf39e987f1a544e28bc780f6aa371adf65aab13ede236f164d20aa1c3347d64
-  data.tar.gz: 9efbab3330d20e966c98df007491bd2e76a244a30562aa0aca36a09947fe16e657f26c8b9f96f39ae6c7bbc16e0fd90322365cbea332412b22a5d56d1d845db0
+  metadata.gz: 636424c4fe4bd18e956cdb93e6c4cf9397531b5cc3d5c56d791a3759a036f2848ded320fee858a18516d3010f2d2cffab567fde6e7186ec3fa3a60def96f9451
+  data.tar.gz: d5520d35c471b83aaf32b64fa534f7268d2b6d0d6873289cf28286eb35bdf3c4f41546d4ee46674c449c8d92d238d5f5d490d70409bfb8b0db3615d495aae1c1

data/History.md

@@ -1,3 +1,84 @@
+## 0.19.2
+
+ASN.1 and X.509 compatibility improvements, new OpenSSL::Timestamp support & 
+upgrading Bouncy Castle to latest.
+
+- [feat] implement `OpenSSL::Timestamp` support (#372)
+- [feat] implement `SSLContext#add_certificate`
+- [compat] improve ASN.1 BER parsing, including high tags, indefinite lengths,
+  nested constructed values, malformed input, EOC, SET ordering and tagging
+- [compat] preserve X.509 RDN sets and CRL extension order
+- [compat] implement `OCSP::Request#signed?` and `X509::Revoked#to_der`
+- [compat] improve CRL and `Time` writer handling
+- [compat] align `ASN1::ObjectId` handling with MRI
+- [compat] improve extended key usage parsing
+- [compat] reject invalid DH peer values
+- [compat] add BN `mod_sqrt` and left/right shift support
+- [compat] reject incomplete PKCS7 recipients and non-SET X.509 attribute values
+- [compat] ignore `FAIL_IF_NO_PEER_CERT` without `VERIFY_PEER`
+- [compat] reject unexpected TLS EOFs unless `OP_IGNORE_UNEXPECTED_EOF` is enabled
+- [compat] align SSL `close_notify` handling with OpenSSL
+- [compat] add `SSLSocket#readbyte`
+- [compat] verify PKCS12 PBMAC1 across BC-FIPS versions
+- [fix] harden OCSP response verification
+- [fix] encode long-form ASN.1 lengths correctly
+- [fix] preserve changes made to `X509::CRL`
+- [fix] try all certificates with the issuer's subject name
+- [fix] match CRLs from the same issuer
+- [fix] encode empty PKCS7 signer signatures (#373)
+- [fix] wait for partial TLS records before unwrapping
+- [fix] interrupt blocking SSL reads when the socket is closed concurrently
+- [fix] avoid shutdown spin on non-blocking SSL writes
+- [fix] retry a full handshake when TLS session reuse fails (#369)
+- [deps] upgrade BC to version 1.86
+
+## 0.16.3
+
+- [deps] upgrade BC to version 1.86
+
+## 0.19.1
+
+X25519/X448 key support and DH key reading, and a (final) round of provider 
+routing driven by the FIPS variant
+
+- [feat] X25519/X448 type `PKey` support
+  `PKey.read`, `generate_key` and `new_raw_private/public_key` now handle XDH
+- [feat] read DH keys (not just DH parameters)
+  PKCS#8 and SubjectPublicKeyInfo DH keys previously failed to parse
+- [compat] read DH parameters via `OpenSSL::PKey.read`
+- [compat] ASN.1 objects for the RFC 8410 curves
+  `ASN1::ObjectId` could not resolve X25519/X448/ED25519/ED448 by name or OID
+- [compat] `PKey#inspect` reporting `oid` and `type_name`
+- [compat] define `OP_NO_RENEGOTIATION` constant
+- [fix] read back DER written by `PKey#to_der`
+  `PKey.read` only tried PKCS#8 on DER input
+- [fix] raise `PKeyError` for unsupported public key algorithm
+- [fix] raise `SSLError` on handshake failure in connect (#204)
+  JSSE may abort handshake with a plain exception when no protocol is enabled
+- [compat] read and write PKCS12 through Bouncy Castle
+  supports OpenSSL 3 PBES2/PBKDF2 encryption and PBMAC1 MACs without JDK KeyStore
+- [compat] honor `PKCS12.create` PBE and iteration arguments
+  regular mode writes requested legacy PBE algorithms (FIPS rejects unapproved)
+- [feat] honor configured Java trust store properties
+  load explicit `javax.net.ssl.trustStore` using the configured `trustStoreType`,
+  `trustStoreProvider` and `trustStorePassword`
+- [deps] bump bcprov artifact to latest patch (1.85.2)
+
+### Provider Routing
+
+Operations that resolved through JDK security now go to the configured provider.
+
+- [fips] pin provider when signing certificates and CRLs
+- [fips] use provider when verifying certificates
+  `X509Certificate#verify(PublicKey)` goes to the JDK default and a certificate
+  read from a JKS keystore stays a `sun.security.x509.X509CertImpl`
+- [fips] generate DSA keys through provider
+  `generate_key!` derived private exponent by hand instead of asking for a key pair
+- [fips] keep cipher policy + OCSP digests on provider
+- [fips] report **fips_mode** based on approved-only
+  `OpenSSL.fips_mode` now reports whether FIPS is being *enforced*, as C does;
+  `OPENSSL_FIPS` reports whether the build is FIPS-*capable*
+
 ## 0.19.0
 
 FIPS support, distributed as a **separate, dual GPL/commercial artifact**.

data/Mavenfile

@@ -101,7 +101,7 @@ plugin :deploy, '3.1.4' do
   execute_goals( :deploy, skip: '${gem.deploy.skip}' )
 end
 
-supported_bc_versions = %w{ 1.80 1.81 1.82 1.83 1.84 1.85 }
+supported_bc_versions = %w{ 1.80 1.81 1.82 1.83 1.84 1.85 1.86 }
 
 default_bc_version = File.read File.expand_path('lib/jopenssl/version.rb', File.dirname(__FILE__))
 default_bc_version = default_bc_version[/BOUNCY_CASTLE_VERSION\s?=\s?'(.*?)'/, 1]
@@ -149,7 +149,7 @@ jruby_versions = []
 jruby_versions += %w{ 9.2.19.0 9.2.20.1 }
 jruby_versions += %w{ 9.3.3.0 9.3.13.0 }
 jruby_versions += %w{ 9.4.8.0 9.4.14.0 9.4.15.0 9.4.16.0 }
-jruby_versions += %w{ 10.0.1.0 10.0.3.0 10.0.5.0 10.0.6.0 }
+jruby_versions += %w{ 10.0.1.0 10.0.3.0 10.0.5.0 10.0.6.0 10.0.7.0 10.1.1.0 10.1.2.0 }
 
 jruby_versions.each do |version|
   profile id: "test-#{version}" do

data/README.md

@@ -13,7 +13,9 @@ the JRuby [mailing list][1] or the [bug tracker][2].
 
 ## Compatibility
 
-Check latest jruby-openssl gem spec's `jar` *requirements* for compatibility.
+Java compatibility is expected to be the same as with supported JRuby versions.
+
+Check latest jruby-openssl gem spec's `jar` *requirements* for (BC) compatibility.
 
 ```ruby
 require 'openssl'
@@ -28,7 +30,7 @@ For older versions of the gem compatibility wasn't reported:
 | ~>0.13.x      | 9.1.x-9.4.x  |  Java 8-17 |    1.68-1.69 |
 | ~>0.14.x      | 9.1.x-9.4.x  |  Java 8-21 |    1.71-1.74 |
 | ~>0.15.x      | 9.2.x-10.0.x |  Java 8-25 |    1.78-1.83 |
-| ~>0.16.x      | 9.3.x-10.0.x |  Java 8-25 |    1.83-1.85 |
+| ~>0.16.x      | 9.3.x-10.1.x |  Java 8-25 |    1.83-1.86 |
 
 ## Security
 
@@ -78,7 +80,7 @@ same `require 'openssl'`. But there are limitations on the JVM (with JCE and JSS
 Bouncy Castle libraries, so some entry points are unavailable, behave differently, or are no-ops.
 
 **Engine**
-- `OpenSSL::Engine` is not implemented - there is no hardware/engine layer, `OpenSSL::Engine.*`
+- `OpenSSL::Engine` is not implemented - there is no hardware/engine layer, `OpenSSL::Engine`
   raises `NameError` (uninitialized constant)
 
 **SSL / TLS** (backed by JSSE)
@@ -103,13 +105,17 @@ Bouncy Castle libraries, so some entry points are unavailable, behave differentl
 - EdDSA (`Ed25519` / `Ed448`) rejects digest arguments
 
 **X509**
-- multi-valued RDNs (the `+` separator in a DN string) are not supported and raise `X509::NameError`.
+- multi-valued RDNs (the `+` separator in a DN string) are not supported and raise `X509::NameError`
 - few `authorityKeyIdentifier` extension configurations are unsupported
 
 **Random**
 - randomness comes from the JVM's `SecureRandom`; the EGD and seed-file APIs (`Random.egd`,
   `egd_bytes`, `load_random_file`, `write_random_file`) are no-ops
 
+**BN**
+- `BN#get_flags` always returns zero; `BN#set_flags(0)` is a no-op; the OpenSSL constant-time mode
+  (`BN::CONSTTIME`) is not supported
+
 **Other**
 - `OpenSSL.fips_mode = true` raises `NotImplementedError` unless the separate [FIPS variant](#fips)
   gem is installed

data/Rakefile

@@ -25,16 +25,17 @@ task :clean do
   sh("#{mvnw} clean")
 end
 
-task :build do
+task :build_release do
   source_date_epoch!
-  sh("#{mvnw} -Prelease -DupdateReleaseInfo=true #{_build_output_timestamp} clean package")
+  sh("#{mvnw} -Prelease -DupdateReleaseInfo=true #{_build_output_timestamp} package")
 end
 
-desc "Sanity-check the tree/version, then build a reproducible release gem"
+desc "Sanity-check tree/version, then build a reproducible release gem"
 task :release => :release_check do
   source_date_epoch! # pin to the release commit so the gem + jar use the same
   puts "SOURCE_DATE_EPOCH=#{ENV['SOURCE_DATE_EPOCH']} (#{Time.at(ENV['SOURCE_DATE_EPOCH'].to_i).utc})"
-  Rake::Task[:build].invoke
+  Rake::Task[:clean].invoke
+  Rake::Task[:build_release].invoke
   gem = Dir['target/*.gem', 'pkg/*.gem'].max_by { |f| File.mtime(f) }
   abort "release aborted - no .gem produced" unless gem
   puts "built #{gem}"
@@ -55,8 +56,12 @@ task :release_check do
   branch = `git rev-parse --abbrev-ref HEAD`.strip
   warn "WARNING: releasing from '#{branch}' (not 'master')" unless branch == 'master'
 
-  tag = `git tag --points-at HEAD`.split("\n").find { |t| t =~ /#{Regexp.escape(version)}/ }
-  warn "WARNING: no git tag matching #{version} points at HEAD" unless tag
+  expected_tag = "v#{version}" # release tags are vX.Y.Z
+  tags = `git tag --points-at HEAD`.split("\n")
+  unless tags.include?(expected_tag)
+    found = tags.empty? ? 'none' : tags.join(', ')
+    warn "WARNING: no #{expected_tag} tag points at HEAD (tags at HEAD: #{found})"
+  end
 
   puts "release checks passed for #{version}"
 end
@@ -69,7 +74,7 @@ task :jar_release => :release_check do
   # deploy (gpg-sign + push): #{File.basename(mvnw)} deploy -Prelease,jar-release -D...
 end
 
-task :default => :build
+task :default => :jar
 
 file('lib/jopenssl.jar') { Rake::Task[:jar].invoke }
 
@@ -90,6 +95,37 @@ task :test => ['lib/jopenssl.jar', 'pkg/test-classes/org/jruby/ext/openssl/Secur
 require_relative 'tasks/vendor_tests'
 define_vendor_test_tasks # root + jopenssl_lib default to this tree
 
+require_relative 'tasks/provider_tests'
+namespace :test do
+  namespace :provider do
+    define_provider_test_task :bc_all,
+                              description: 'Run tests with BC providers registered through java.security',
+                              providers: [
+                                { name: 'BC', class: 'org.bouncycastle.jce.provider.BouncyCastleProvider' },
+                                { name: 'BCJSSE', class: 'org.bouncycastle.jsse.provider.BouncyCastleJsseProvider' }
+                              ],
+                              jars: -> { FileList['vendor/**/*.jar'].map { |path| File.expand_path(path) } }
+    define_provider_test_task :bc_wout_jsse,
+                              description: 'Run tests with only BC provider registered (without BC-JSSE)',
+                              providers: [
+                                { name: 'BC', class: 'org.bouncycastle.jce.provider.BouncyCastleProvider' },
+                              ],
+                              jdk_providers: ['SUN', 'SunJSSE', 'SunJCE', 'SunEC'],
+                              jars: -> { FileList['vendor/**/*.jar'].map { |path| File.expand_path(path) } }
+  end
+
+  desc 'Run regular and provider test suites'
+  task :all do
+    %w[
+      test
+      test:provider:bc_all
+      test:provider:bc_wout_jsse
+    ].each do |name|
+      Rake::Task[name].invoke
+    end
+  end
+end
+
 namespace :integration do
   it_path = File.expand_path('integration', File.dirname(__FILE__))
   task :install do

data/lib/jopenssl/load.rb

@@ -1,24 +1,26 @@
 require_relative 'version'
 
 # NOTE: assuming user does pull in BC .jars from somewhere else on the class-path
-if ENV_JAVA['jruby.openssl.load.jars'] != 'false' &&
-   java.security.Security.getProvider('BC').nil?
-  version = JOpenSSL::BOUNCY_CASTLE_VERSION
+if ENV_JAVA['jruby.openssl.load.jars'] != 'false' && java.security.Security.getProvider('BC').nil?
   bc_jars = begin
     require 'jar_dependencies' unless respond_to?(:require_jar, true)
-    require_jar 'org.bouncycastle', 'bcprov-jdk18on', version
-    require_jar 'org.bouncycastle', 'bcpkix-jdk18on', version
-    require_jar 'org.bouncycastle', 'bcutil-jdk18on', version
-    require_jar 'org.bouncycastle', 'bctls-jdk18on',  version
+    require_jar 'org.bouncycastle', 'bcprov-jdk18on', JOpenSSL.version('bcprov-jdk18on')
+    require_jar 'org.bouncycastle', 'bcpkix-jdk18on', JOpenSSL.version('bcpkix-jdk18on')
+    require_jar 'org.bouncycastle', 'bcutil-jdk18on', JOpenSSL.version('bcutil-jdk18on')
+    require_jar 'org.bouncycastle', 'bctls-jdk18on',  JOpenSSL.version('bctls-jdk18on')
     true
   rescue LoadError, RuntimeError
     false
   end
   unless bc_jars
-    vendor = File.expand_path('../../vendor', __dir__)
+    vendor = File.expand_path('../../vendor', File.dirname(__FILE__))
+    version = JOpenSSL.version('bcprov-jdk18on')
     load "#{vendor}/org/bouncycastle/bcprov-jdk18on/#{version}/bcprov-jdk18on-#{version}.jar"
+    version = JOpenSSL.version('bcpkix-jdk18on')
     load "#{vendor}/org/bouncycastle/bcpkix-jdk18on/#{version}/bcpkix-jdk18on-#{version}.jar"
+    version = JOpenSSL.version('bcutil-jdk18on')
     load "#{vendor}/org/bouncycastle/bcutil-jdk18on/#{version}/bcutil-jdk18on-#{version}.jar"
+    version = JOpenSSL.version('bctls-jdk18on')
     load "#{vendor}/org/bouncycastle/bctls-jdk18on/#{version}/bctls-jdk18on-#{version}.jar"
   end
 end

data/lib/jopenssl/version.rb

@@ -1,5 +1,16 @@
 # frozen_string_literal: true
 module JOpenSSL
-  VERSION = '0.19.0'
-  BOUNCY_CASTLE_VERSION = '1.85'
+  VERSION = '0.19.2'
+  BOUNCY_CASTLE_VERSION = '1.86'
+
+  # @private
+  BOUNCY_CASTLE_PATCH_VERSIONS = {
+    'bctls-jdk18on' => "#{BOUNCY_CASTLE_VERSION}.1"
+  }.freeze
+  private_constant :BOUNCY_CASTLE_PATCH_VERSIONS
+
+  # @private
+  def self.version(artifact_id)
+    BOUNCY_CASTLE_PATCH_VERSIONS.fetch(artifact_id, BOUNCY_CASTLE_VERSION)
+  end
 end

data/lib/openssl/buffering.rb

@@ -107,6 +107,12 @@ module OpenSSL::Buffering
     read(1)&.ord
   end
 
+  # Get the next 8bit byte. Raises EOFError on EOF
+  def readbyte
+    raise EOFError if eof?
+    getbyte
+  end
+
   ##
   # Reads _size_ bytes from the stream.  If _buf_ is provided it must
   # reference a string which will receive the data.
@@ -225,7 +231,7 @@ module OpenSSL::Buffering
   #
   # Unlike IO#gets the separator must be provided if a limit is provided.
 
-  def gets(eol=$/, limit=nil)
+  def gets(eol=$/, limit=nil, chomp: false)
     idx = @rbuffer.index(eol)
     until @eof
       break if idx
@@ -240,7 +246,9 @@ module OpenSSL::Buffering
     if size && limit && limit >= 0
       size = [size, limit].min
     end
-    consume_rbuff(size)
+    line = consume_rbuff(size)
+    line.chomp!(eol) if chomp && line
+    line
   end
 
   ##

data/pom.xml

@@ -11,7 +11,7 @@ DO NOT MODIFY - GENERATED CODE
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.jruby.openssl</groupId>
   <artifactId>jruby-openssl</artifactId>
-  <version>0.19.0</version>
+  <version>0.19.2</version>
   <packaging>gem</packaging>
   <name>SSL/TLS and general-purpose cryptography for JRuby</name>
   <description>Ruby OpenSSL compatibility for JRuby, based on Java JCA/JCE and Bouncy Castle libraries (does not depend on native OpenSSL).</description>
@@ -55,7 +55,7 @@ DO NOT MODIFY - GENERATED CODE
     </snapshotRepository>
   </distributionManagement>
   <properties>
-    <bc.versions>1.85</bc.versions>
+    <bc.versions>1.86</bc.versions>
     <gem.deploy.skip>false</gem.deploy.skip>
     <invoker.skip>${maven.test.skip}</invoker.skip>
     <invoker.test>${bc.versions}</invoker.test>
@@ -75,22 +75,22 @@ DO NOT MODIFY - GENERATED CODE
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcprov-jdk18on</artifactId>
-      <version>[1.80,1.85]</version>
+      <version>[1.80,1.86]</version>
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcpkix-jdk18on</artifactId>
-      <version>[1.80,1.85]</version>
+      <version>[1.80,1.86]</version>
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bctls-jdk18on</artifactId>
-      <version>[1.80,1.85]</version>
+      <version>[1.80,1.86.1]</version>
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcutil-jdk18on</artifactId>
-      <version>[1.80,1.85]</version>
+      <version>[1.80,1.86]</version>
     </dependency>
     <dependency>
       <groupId>org.jruby</groupId>
@@ -405,7 +405,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.2.19.0</jruby.version>
         <jruby.versions>9.2.19.0</jruby.versions>
       </properties>
@@ -442,7 +442,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.2.20.1</jruby.version>
         <jruby.versions>9.2.20.1</jruby.versions>
       </properties>
@@ -479,7 +479,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.3.3.0</jruby.version>
         <jruby.versions>9.3.3.0</jruby.versions>
       </properties>
@@ -516,7 +516,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.3.13.0</jruby.version>
         <jruby.versions>9.3.13.0</jruby.versions>
       </properties>
@@ -553,7 +553,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.4.8.0</jruby.version>
         <jruby.versions>9.4.8.0</jruby.versions>
       </properties>
@@ -590,7 +590,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.4.14.0</jruby.version>
         <jruby.versions>9.4.14.0</jruby.versions>
       </properties>
@@ -627,7 +627,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.4.15.0</jruby.version>
         <jruby.versions>9.4.15.0</jruby.versions>
       </properties>
@@ -664,7 +664,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.4.16.0</jruby.version>
         <jruby.versions>9.4.16.0</jruby.versions>
       </properties>
@@ -701,7 +701,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>10.0.1.0</jruby.version>
         <jruby.versions>10.0.1.0</jruby.versions>
       </properties>
@@ -738,7 +738,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>10.0.3.0</jruby.version>
         <jruby.versions>10.0.3.0</jruby.versions>
       </properties>
@@ -775,7 +775,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>10.0.5.0</jruby.version>
         <jruby.versions>10.0.5.0</jruby.versions>
       </properties>
@@ -812,11 +812,122 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>10.0.6.0</jruby.version>
         <jruby.versions>10.0.6.0</jruby.versions>
       </properties>
     </profile>
+    <profile>
+      <id>test-10.0.7.0</id>
+      <build>
+        <plugins>
+          <plugin>
+            <artifactId>maven-invoker-plugin</artifactId>
+            <version>3.8.1</version>
+            <executions>
+              <execution>
+                <goals>
+                  <goal>install</goal>
+                  <goal>run</goal>
+                </goals>
+                <configuration>
+                  <projectsDirectory>src/it</projectsDirectory>
+                  <pomIncludes>
+                    <pomInclude>*/pom.xml</pomInclude>
+                  </pomIncludes>
+                  <streamLogs>true</streamLogs>
+                  <properties>
+                    <jruby.versions>${jruby.versions}</jruby.versions>
+                    <jruby.openssl.version>${project.version}</jruby.openssl.version>
+                    <bc.versions>${bc.versions}</bc.versions>
+                    <runit.dir>${runit.dir}</runit.dir>
+                  </properties>
+                </configuration>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+      <properties>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
+        <jruby.version>10.0.7.0</jruby.version>
+        <jruby.versions>10.0.7.0</jruby.versions>
+      </properties>
+    </profile>
+    <profile>
+      <id>test-10.1.1.0</id>
+      <build>
+        <plugins>
+          <plugin>
+            <artifactId>maven-invoker-plugin</artifactId>
+            <version>3.8.1</version>
+            <executions>
+              <execution>
+                <goals>
+                  <goal>install</goal>
+                  <goal>run</goal>
+                </goals>
+                <configuration>
+                  <projectsDirectory>src/it</projectsDirectory>
+                  <pomIncludes>
+                    <pomInclude>*/pom.xml</pomInclude>
+                  </pomIncludes>
+                  <streamLogs>true</streamLogs>
+                  <properties>
+                    <jruby.versions>${jruby.versions}</jruby.versions>
+                    <jruby.openssl.version>${project.version}</jruby.openssl.version>
+                    <bc.versions>${bc.versions}</bc.versions>
+                    <runit.dir>${runit.dir}</runit.dir>
+                  </properties>
+                </configuration>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+      <properties>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
+        <jruby.version>10.1.1.0</jruby.version>
+        <jruby.versions>10.1.1.0</jruby.versions>
+      </properties>
+    </profile>
+    <profile>
+      <id>test-10.1.2.0</id>
+      <build>
+        <plugins>
+          <plugin>
+            <artifactId>maven-invoker-plugin</artifactId>
+            <version>3.8.1</version>
+            <executions>
+              <execution>
+                <goals>
+                  <goal>install</goal>
+                  <goal>run</goal>
+                </goals>
+                <configuration>
+                  <projectsDirectory>src/it</projectsDirectory>
+                  <pomIncludes>
+                    <pomInclude>*/pom.xml</pomInclude>
+                  </pomIncludes>
+                  <streamLogs>true</streamLogs>
+                  <properties>
+                    <jruby.versions>${jruby.versions}</jruby.versions>
+                    <jruby.openssl.version>${project.version}</jruby.openssl.version>
+                    <bc.versions>${bc.versions}</bc.versions>
+                    <runit.dir>${runit.dir}</runit.dir>
+                  </properties>
+                </configuration>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+      <properties>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
+        <jruby.version>10.1.2.0</jruby.version>
+        <jruby.versions>10.1.2.0</jruby.versions>
+      </properties>
+    </profile>
     <profile>
       <id>release</id>
       <build>
@@ -931,6 +1042,7 @@ DO NOT MODIFY - GENERATED CODE
                         <include>org/jruby/ext/openssl/PKeyEdDSA.java</include>
                         <include>org/jruby/ext/openssl/PKeyHMAC.java</include>
                         <include>org/jruby/ext/openssl/PKeyRSA.java</include>
+                        <include>org/jruby/ext/openssl/PKeyXDH.java</include>
                         <include>org/jruby/ext/openssl/Random.java</include>
                         <include>org/jruby/ext/openssl/SSL.java</include>
                         <include>org/jruby/ext/openssl/SSLContext.java</include>
@@ -939,6 +1051,7 @@ DO NOT MODIFY - GENERATED CODE
                         <include>org/jruby/ext/openssl/SecurityHelper.java</include>
                         <include>org/jruby/ext/openssl/SimpleSecretKey.java</include>
                         <include>org/jruby/ext/openssl/StringHelper.java</include>
+                        <include>org/jruby/ext/openssl/Timestamp.java</include>
                         <include>org/jruby/ext/openssl/X509.java</include>
                         <include>org/jruby/ext/openssl/X509Attribute.java</include>
                         <include>org/jruby/ext/openssl/X509CRL.java</include>
@@ -982,6 +1095,7 @@ DO NOT MODIFY - GENERATED CODE
                         <include>org/jruby/ext/openssl/impl/PKCS7DataDigest.java</include>
                         <include>org/jruby/ext/openssl/impl/PKCS7DataEncrypted.java</include>
                         <include>org/jruby/ext/openssl/impl/PKCS7DataEnveloped.java</include>
+                        <include>org/jruby/ext/openssl/impl/PKCS7DataOther.java</include>
                         <include>org/jruby/ext/openssl/impl/PKCS7DataSigned.java</include>
                         <include>org/jruby/ext/openssl/impl/PKCS7DataSignedAndEnveloped.java</include>
                         <include>org/jruby/ext/openssl/impl/PKCS7Exception.java</include>
@@ -992,8 +1106,6 @@ DO NOT MODIFY - GENERATED CODE
                         <include>org/jruby/ext/openssl/impl/Signed.java</include>
                         <include>org/jruby/ext/openssl/impl/SignerInfoWithPkey.java</include>
                         <include>org/jruby/ext/openssl/impl/TypeDiscriminating.java</include>
-                        <include>org/jruby/ext/openssl/impl/pem/MiscPEMGeneratorHelper.java</include>
-                        <include>org/jruby/ext/openssl/impl/pem/PEMUtilities.java</include>
                         <include>org/jruby/ext/openssl/log/DefaultLogger.java</include>
                         <include>org/jruby/ext/openssl/log/JULLogger.java</include>
                         <include>org/jruby/ext/openssl/log/Logger.java</include>
@@ -1002,10 +1114,10 @@ DO NOT MODIFY - GENERATED CODE
                         <include>org/jruby/ext/openssl/shim/CipherShim.java</include>
                         <include>org/jruby/ext/openssl/shim/ErrorShim.java</include>
                         <include>org/jruby/ext/openssl/shim/PKeyShim.java</include>
+                        <include>org/jruby/ext/openssl/shim/ProviderShim.java</include>
                         <include>org/jruby/ext/openssl/util/ByteArrayOutputStream.java</include>
                         <include>org/jruby/ext/openssl/util/Cache.java</include>
                         <include>org/jruby/ext/openssl/util/ExceptionUtil.java</include>
-                        <include>org/jruby/ext/openssl/util/PEMGenerator.java</include>
                         <include>org/jruby/ext/openssl/util/RubySupport.java</include>
                         <include>org/jruby/ext/openssl/x509store/CRL.java</include>
                         <include>org/jruby/ext/openssl/x509store/Certificate.java</include>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jruby-openssl
 version: !ruby/object:Gem::Version
-  version: 0.19.0
+  version: 0.19.2
 platform: java
 authors:
 - Karol Bucek
@@ -9,7 +9,7 @@ authors:
 - JRuby contributors
 bindir: bin
 cert_chain: []
-date: 2026-07-29 00:00:00.000000000 Z
+date: 2026-09-25 00:00:00.000000000 Z
 dependencies: []
 description: Ruby OpenSSL compatibility for JRuby, based on Java JCA/JCE and Bouncy
   Castle libraries (does not depend on native OpenSSL).
@@ -40,10 +40,10 @@ files:
 - lib/openssl/ssl.rb
 - lib/openssl/x509.rb
 - pom.xml
-- vendor/org/bouncycastle/bcpkix-jdk18on/1.85/bcpkix-jdk18on-1.85.jar
-- vendor/org/bouncycastle/bcprov-jdk18on/1.85/bcprov-jdk18on-1.85.jar
-- vendor/org/bouncycastle/bctls-jdk18on/1.85/bctls-jdk18on-1.85.jar
-- vendor/org/bouncycastle/bcutil-jdk18on/1.85/bcutil-jdk18on-1.85.jar
+- vendor/org/bouncycastle/bcpkix-jdk18on/1.86/bcpkix-jdk18on-1.86.jar
+- vendor/org/bouncycastle/bcprov-jdk18on/1.86/bcprov-jdk18on-1.86.jar
+- vendor/org/bouncycastle/bctls-jdk18on/1.86.1/bctls-jdk18on-1.86.1.jar
+- vendor/org/bouncycastle/bcutil-jdk18on/1.86/bcutil-jdk18on-1.86.jar
 licenses:
 - EPL-1.0
 - GPL-2.0
@@ -67,10 +67,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements:
-- jar org.bouncycastle:bcprov-jdk18on, [1.80,1.85]
-- jar org.bouncycastle:bcpkix-jdk18on, [1.80,1.85]
-- jar org.bouncycastle:bctls-jdk18on,  [1.80,1.85]
-- jar org.bouncycastle:bcutil-jdk18on, [1.80,1.85]
+- jar org.bouncycastle:bcprov-jdk18on, [1.80,1.86]
+- jar org.bouncycastle:bcpkix-jdk18on, [1.80,1.86]
+- jar org.bouncycastle:bctls-jdk18on,  [1.80,1.86.1]
+- jar org.bouncycastle:bcutil-jdk18on, [1.80,1.86]
 rubygems_version: 3.6.3
 specification_version: 4
 summary: SSL/TLS and general-purpose cryptography for JRuby