jruby-openssl 0.19.1-java → 0.19.3-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d303c479c506753df7b876af7963e7eea17311aff21f7830deab8fb406a99e85
-  data.tar.gz: 24f04a2d978a80711b6271e748068037ad8b4ce4b0f2607ba57aab283c7d980d
+  metadata.gz: 4b2d2e2cfb98fb276169353e0a96ef2c41b5ed9be72afe65f8a533f2af389303
+  data.tar.gz: 56891904f7804768cdf31d8a10f7f86c91ef1a1a86119d297648fb9b293a9f1e
 SHA512:
-  metadata.gz: 43e9318c7276016bec340d935b6e78b019c6a1959cbed2c5b0f2545617618b84e6da586d83291a5dd55d9609d2534fe051228a8af99104e8e96d85054c53e025
-  data.tar.gz: caabdffeedc0fc4a813be83222cceddfc85d254959f32a81ad9b908a84a3feec977b67628484b7af72f30cbbc3469c44287934d8a0945d8782e147e2dee4e0d7
+  metadata.gz: 898da59071f4969cd053072d181954355a668e9fd5011c9b099287bc899e24525e73ff1b8a43efc00a8fd9ca06bcc20e5293e0fc734379863bb62957d4412447
+  data.tar.gz: 58fe61d22c8346b07b27acce29b7aa8fb489e603e2aededac65f94fc05dcf51e6e788af5ae8473c59bf0470539e07e541fcd3dda823f1bbd370f48ed016e9462

data/History.md

@@ -1,3 +1,70 @@
+## 0.19.3
+
+Broader OpenSSL compatibility across PKCS7, X.509, key handling and big numbers,
+with new DH validation and digest enumeration support.
+
+- [feat] implement `Digest.digests` algorithm enumeration
+- [feat] add `PKey::DH#params_ok?` parameter validation
+- [compat] add `PKey::DH#public_key`
+- [feat] add EC `on_curve?` checks and hybrid point serialization
+- [compat] align PKCS7 behavior with OpenSSL
+- [compat] align PKCS12 MAC handling (PKCS12KDF & PBMAC1) with OpenSSL
+- [compat] support configured X.509 extensions
+- [compat] load X.509 certificate chains
+- [compat] support multiple CRL distribution point URIs
+- [compat] format X.509 names like OpenSSL
+- [compat] validate X.509 attribute values
+- [compat] suppress X.509 store callback exceptions
+- [compat] parse DER certificates before trying PEM
+- [compat] align Netscape SPKI serialization with OpenSSL
+- [compat] align OCSP signing with OpenSSL
+- [compat] align BN modular arithmetic and negative string conversion
+- [compat] raise `BNError` for invalid arithmetic
+- [compat] reject `nil` BN values
+- [compat] map invalid X.509 extension values to `ExtensionError`
+- [compat] copy X.509 collection arguments to avoid retaining caller-owned arrays
+- [fix] format zero BN as single hex digit
+- [fix] report BouncyCastle `SecureRandom` initialization errors
+- [fix] reset TLS output buffer after shutdown
+
+## 0.19.2
+
+ASN.1 and X.509 compatibility improvements, new OpenSSL::Timestamp support & 
+upgrading Bouncy Castle to latest.
+
+- [feat] implement `OpenSSL::Timestamp` support (#372)
+- [feat] implement `SSLContext#add_certificate`
+- [compat] improve ASN.1 BER parsing, including high tags, indefinite lengths,
+  nested constructed values, malformed input, EOC, SET ordering and tagging
+- [compat] preserve X.509 RDN sets and CRL extension order
+- [compat] implement `OCSP::Request#signed?` and `X509::Revoked#to_der`
+- [compat] improve CRL and `Time` writer handling
+- [compat] align `ASN1::ObjectId` handling with MRI
+- [compat] improve extended key usage parsing
+- [compat] reject invalid DH peer values
+- [compat] add BN `mod_sqrt` and left/right shift support
+- [compat] reject incomplete PKCS7 recipients and non-SET X.509 attribute values
+- [compat] ignore `FAIL_IF_NO_PEER_CERT` without `VERIFY_PEER`
+- [compat] reject unexpected TLS EOFs unless `OP_IGNORE_UNEXPECTED_EOF` is enabled
+- [compat] align SSL `close_notify` handling with OpenSSL
+- [compat] add `SSLSocket#readbyte`
+- [compat] verify PKCS12 PBMAC1 across BC-FIPS versions
+- [fix] harden OCSP response verification
+- [fix] encode long-form ASN.1 lengths correctly
+- [fix] preserve changes made to `X509::CRL`
+- [fix] try all certificates with the issuer's subject name
+- [fix] match CRLs from the same issuer
+- [fix] encode empty PKCS7 signer signatures (#373)
+- [fix] wait for partial TLS records before unwrapping
+- [fix] interrupt blocking SSL reads when the socket is closed concurrently
+- [fix] avoid shutdown spin on non-blocking SSL writes
+- [fix] retry a full handshake when TLS session reuse fails (#369)
+- [deps] upgrade BC to version 1.86
+
+## 0.16.3
+
+- [deps] upgrade BC to version 1.86
+
 ## 0.19.1
 
 X25519/X448 key support and DH key reading, and a (final) round of provider 

data/Mavenfile

@@ -101,7 +101,7 @@ plugin :deploy, '3.1.4' do
   execute_goals( :deploy, skip: '${gem.deploy.skip}' )
 end
 
-supported_bc_versions = %w{ 1.80 1.81 1.82 1.83 1.84 1.85 }
+supported_bc_versions = %w{ 1.80 1.81 1.82 1.83 1.84 1.85 1.86 }
 
 default_bc_version = File.read File.expand_path('lib/jopenssl/version.rb', File.dirname(__FILE__))
 default_bc_version = default_bc_version[/BOUNCY_CASTLE_VERSION\s?=\s?'(.*?)'/, 1]
@@ -149,7 +149,7 @@ jruby_versions = []
 jruby_versions += %w{ 9.2.19.0 9.2.20.1 }
 jruby_versions += %w{ 9.3.3.0 9.3.13.0 }
 jruby_versions += %w{ 9.4.8.0 9.4.14.0 9.4.15.0 9.4.16.0 }
-jruby_versions += %w{ 10.0.1.0 10.0.3.0 10.0.5.0 10.0.6.0 }
+jruby_versions += %w{ 10.0.1.0 10.0.3.0 10.0.5.0 10.0.6.0 10.0.7.0 10.1.1.0 10.1.2.0 }
 
 jruby_versions.each do |version|
   profile id: "test-#{version}" do

data/README.md

@@ -13,7 +13,9 @@ the JRuby [mailing list][1] or the [bug tracker][2].
 
 ## Compatibility
 
-Check latest jruby-openssl gem spec's `jar` *requirements* for compatibility.
+Java compatibility is expected to be the same as with supported JRuby versions.
+
+Check latest jruby-openssl gem spec's `jar` *requirements* for (BC) compatibility.
 
 ```ruby
 require 'openssl'
@@ -28,7 +30,7 @@ For older versions of the gem compatibility wasn't reported:
 | ~>0.13.x      | 9.1.x-9.4.x  |  Java 8-17 |    1.68-1.69 |
 | ~>0.14.x      | 9.1.x-9.4.x  |  Java 8-21 |    1.71-1.74 |
 | ~>0.15.x      | 9.2.x-10.0.x |  Java 8-25 |    1.78-1.83 |
-| ~>0.16.x      | 9.3.x-10.0.x |  Java 8-25 |    1.83-1.85 |
+| ~>0.16.x      | 9.3.x-10.1.x |  Java 8-25 |    1.83-1.86 |
 
 ## Security
 
@@ -78,14 +80,18 @@ same `require 'openssl'`. But there are limitations on the JVM (with JCE and JSS
 Bouncy Castle libraries, so some entry points are unavailable, behave differently, or are no-ops.
 
 **Engine**
-- `OpenSSL::Engine` is not implemented - there is no hardware/engine layer, `OpenSSL::Engine.*`
+- `OpenSSL::Engine` is not implemented - there is no hardware/engine layer, `OpenSSL::Engine`
   raises `NameError` (uninitialized constant)
 
 **SSL / TLS** (backed by JSSE)
 - `SSLSocket#state` and NPN (`#npn_protocol`) are unimplemented and return `nil` - use ALPN instead
+- `SSLSocket#close_write` closes both TLS directions even on TLS 1.3; reading a peer response afterward 
+  is unsupported, use message lengths or delimiters to frame requests instead of TLS EOF 
+  NOTE: that you can enforce the half-close when using the JDK built-in SunJSSE provider
 - Forced session resumption (`SSLSocket#session=`) is best-effort and only fully works with the
   BouncyCastle JSSE provider; `session_reused?` may return `nil` ("can't decide")
-- `SSL::Session#id=` / `#time=` are no-ops; `SSL::Session.new` on a non-socket raises `NotImplementedError`
+- `SSL::Session#id=` / `#time=` are no-ops 
+- `SSL::Session.new` on a non-socket raises `NotImplementedError`
 - Hostname / `subjectAltName` matching runs over Java's certificate parsing and can differ from
   MRI's `GeneralName` handling in edge cases
 
@@ -97,19 +103,22 @@ Bouncy Castle libraries, so some entry points are unavailable, behave differentl
 
 **PKey** (EC / DH / EdDSA)
 - EC is limited to prime curves (`:GFp`); binary-field curves (`:GF2m`) fail
-- `EC::Point#mul` with array arguments, `:hybrid` point compression, and encrypted EC private-key
-  export are not implemented
-- `DH#set_pqg` accepts but silently ignores the `q` parameter
+- `EC::Point#mul` with array arguments and encrypted EC private-key export are not implemented
+- `DH#set_pqg` ignores the `q` parameter (and warns when it is non-`nil`)
 - EdDSA (`Ed25519` / `Ed448`) rejects digest arguments
 
 **X509**
-- multi-valued RDNs (the `+` separator in a DN string) are not supported and raise `X509::NameError`.
+- multi-valued RDNs (the `+` separator in a DN string) are not supported and raise `X509::NameError`
 - few `authorityKeyIdentifier` extension configurations are unsupported
 
 **Random**
 - randomness comes from the JVM's `SecureRandom`; the EGD and seed-file APIs (`Random.egd`,
   `egd_bytes`, `load_random_file`, `write_random_file`) are no-ops
 
+**BN**
+- `BN#get_flags` always returns zero; `BN#set_flags(0)` is a no-op; the OpenSSL constant-time mode
+  (`BN::CONSTTIME`) is not supported
+
 **Other**
 - `OpenSSL.fips_mode = true` raises `NotImplementedError` unless the separate [FIPS variant](#fips)
   gem is installed

data/Rakefile

@@ -95,6 +95,9 @@ task :test => ['lib/jopenssl.jar', 'pkg/test-classes/org/jruby/ext/openssl/Secur
 require_relative 'tasks/vendor_tests'
 define_vendor_test_tasks # root + jopenssl_lib default to this tree
 
+require_relative 'tasks/mri_tests'
+define_mri_test_task
+
 require_relative 'tasks/provider_tests'
 namespace :test do
   namespace :provider do

data/lib/jopenssl/version.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 module JOpenSSL
-  VERSION = '0.19.1'
-  BOUNCY_CASTLE_VERSION = '1.85'
+  VERSION = '0.19.3'
+  BOUNCY_CASTLE_VERSION = '1.86'
 
   # @private
   BOUNCY_CASTLE_PATCH_VERSIONS = {
-    'bcprov-jdk18on' => "#{BOUNCY_CASTLE_VERSION}.2"
+    'bctls-jdk18on' => "#{BOUNCY_CASTLE_VERSION}.1"
   }.freeze
   private_constant :BOUNCY_CASTLE_PATCH_VERSIONS
 

data/lib/openssl/buffering.rb

@@ -107,6 +107,12 @@ module OpenSSL::Buffering
     read(1)&.ord
   end
 
+  # Get the next 8bit byte. Raises EOFError on EOF
+  def readbyte
+    raise EOFError if eof?
+    getbyte
+  end
+
   ##
   # Reads _size_ bytes from the stream.  If _buf_ is provided it must
   # reference a string which will receive the data.
@@ -225,7 +231,7 @@ module OpenSSL::Buffering
   #
   # Unlike IO#gets the separator must be provided if a limit is provided.
 
-  def gets(eol=$/, limit=nil)
+  def gets(eol=$/, limit=nil, chomp: false)
     idx = @rbuffer.index(eol)
     until @eof
       break if idx
@@ -240,7 +246,9 @@ module OpenSSL::Buffering
     if size && limit && limit >= 0
       size = [size, limit].min
     end
-    consume_rbuff(size)
+    line = consume_rbuff(size)
+    line.chomp!(eol) if chomp && line
+    line
   end
 
   ##

data/lib/openssl/ssl.rb

@@ -489,6 +489,8 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
       # Therefore, on TLS 1.2, this method will cause the connection to be
       # completely shut down. On TLS 1.3, the connection will remain open for
       # reading only.
+      #
+      # NOTE: JRuby, when using BC-JSSE, closes both directions even on TLS 1.3
       def close_write
         stop
       end

data/lib/openssl/x509.rb

@@ -135,19 +135,19 @@ module OpenSSL
             raise ASN1::ASN1Error, "invalid extension"
           end
 
-          crl_uris = cdp_asn1.map do |crl_distribution_point|
+          crl_uris = cdp_asn1.flat_map do |crl_distribution_point|
             distribution_point = crl_distribution_point.value.find do |v|
               v.tag_class == :CONTEXT_SPECIFIC && v.tag == 0
             end
             full_name = distribution_point&.value&.find do |v|
               v.tag_class == :CONTEXT_SPECIFIC && v.tag == 0
             end
-            full_name&.value&.find do |v|
+            full_name&.value&.select do |v|
               v.tag_class == :CONTEXT_SPECIFIC && v.tag == 6 # uniformResourceIdentifier
             end
           end
 
-          crl_uris&.map(&:value)
+          crl_uris.empty? ? nil : crl_uris.map(&:value)
         end
       end
 

data/pom.xml

@@ -11,7 +11,7 @@ DO NOT MODIFY - GENERATED CODE
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.jruby.openssl</groupId>
   <artifactId>jruby-openssl</artifactId>
-  <version>0.19.1</version>
+  <version>0.19.3</version>
   <packaging>gem</packaging>
   <name>SSL/TLS and general-purpose cryptography for JRuby</name>
   <description>Ruby OpenSSL compatibility for JRuby, based on Java JCA/JCE and Bouncy Castle libraries (does not depend on native OpenSSL).</description>
@@ -55,7 +55,7 @@ DO NOT MODIFY - GENERATED CODE
     </snapshotRepository>
   </distributionManagement>
   <properties>
-    <bc.versions>1.85</bc.versions>
+    <bc.versions>1.86</bc.versions>
     <gem.deploy.skip>false</gem.deploy.skip>
     <invoker.skip>${maven.test.skip}</invoker.skip>
     <invoker.test>${bc.versions}</invoker.test>
@@ -75,22 +75,22 @@ DO NOT MODIFY - GENERATED CODE
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcprov-jdk18on</artifactId>
-      <version>[1.80,1.85.2]</version>
+      <version>[1.80,1.86]</version>
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcpkix-jdk18on</artifactId>
-      <version>[1.80,1.85]</version>
+      <version>[1.80,1.86]</version>
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bctls-jdk18on</artifactId>
-      <version>[1.80,1.85]</version>
+      <version>[1.80,1.86.1]</version>
     </dependency>
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bcutil-jdk18on</artifactId>
-      <version>[1.80,1.85]</version>
+      <version>[1.80,1.86]</version>
     </dependency>
     <dependency>
       <groupId>org.jruby</groupId>
@@ -405,7 +405,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.2.19.0</jruby.version>
         <jruby.versions>9.2.19.0</jruby.versions>
       </properties>
@@ -442,7 +442,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.2.20.1</jruby.version>
         <jruby.versions>9.2.20.1</jruby.versions>
       </properties>
@@ -479,7 +479,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.3.3.0</jruby.version>
         <jruby.versions>9.3.3.0</jruby.versions>
       </properties>
@@ -516,7 +516,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.3.13.0</jruby.version>
         <jruby.versions>9.3.13.0</jruby.versions>
       </properties>
@@ -553,7 +553,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.4.8.0</jruby.version>
         <jruby.versions>9.4.8.0</jruby.versions>
       </properties>
@@ -590,7 +590,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.4.14.0</jruby.version>
         <jruby.versions>9.4.14.0</jruby.versions>
       </properties>
@@ -627,7 +627,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.4.15.0</jruby.version>
         <jruby.versions>9.4.15.0</jruby.versions>
       </properties>
@@ -664,7 +664,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>9.4.16.0</jruby.version>
         <jruby.versions>9.4.16.0</jruby.versions>
       </properties>
@@ -701,7 +701,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>10.0.1.0</jruby.version>
         <jruby.versions>10.0.1.0</jruby.versions>
       </properties>
@@ -738,7 +738,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>10.0.3.0</jruby.version>
         <jruby.versions>10.0.3.0</jruby.versions>
       </properties>
@@ -775,7 +775,7 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>10.0.5.0</jruby.version>
         <jruby.versions>10.0.5.0</jruby.versions>
       </properties>
@@ -812,11 +812,122 @@ DO NOT MODIFY - GENERATED CODE
         </plugins>
       </build>
       <properties>
-        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85</bc.versions>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
         <jruby.version>10.0.6.0</jruby.version>
         <jruby.versions>10.0.6.0</jruby.versions>
       </properties>
     </profile>
+    <profile>
+      <id>test-10.0.7.0</id>
+      <build>
+        <plugins>
+          <plugin>
+            <artifactId>maven-invoker-plugin</artifactId>
+            <version>3.8.1</version>
+            <executions>
+              <execution>
+                <goals>
+                  <goal>install</goal>
+                  <goal>run</goal>
+                </goals>
+                <configuration>
+                  <projectsDirectory>src/it</projectsDirectory>
+                  <pomIncludes>
+                    <pomInclude>*/pom.xml</pomInclude>
+                  </pomIncludes>
+                  <streamLogs>true</streamLogs>
+                  <properties>
+                    <jruby.versions>${jruby.versions}</jruby.versions>
+                    <jruby.openssl.version>${project.version}</jruby.openssl.version>
+                    <bc.versions>${bc.versions}</bc.versions>
+                    <runit.dir>${runit.dir}</runit.dir>
+                  </properties>
+                </configuration>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+      <properties>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
+        <jruby.version>10.0.7.0</jruby.version>
+        <jruby.versions>10.0.7.0</jruby.versions>
+      </properties>
+    </profile>
+    <profile>
+      <id>test-10.1.1.0</id>
+      <build>
+        <plugins>
+          <plugin>
+            <artifactId>maven-invoker-plugin</artifactId>
+            <version>3.8.1</version>
+            <executions>
+              <execution>
+                <goals>
+                  <goal>install</goal>
+                  <goal>run</goal>
+                </goals>
+                <configuration>
+                  <projectsDirectory>src/it</projectsDirectory>
+                  <pomIncludes>
+                    <pomInclude>*/pom.xml</pomInclude>
+                  </pomIncludes>
+                  <streamLogs>true</streamLogs>
+                  <properties>
+                    <jruby.versions>${jruby.versions}</jruby.versions>
+                    <jruby.openssl.version>${project.version}</jruby.openssl.version>
+                    <bc.versions>${bc.versions}</bc.versions>
+                    <runit.dir>${runit.dir}</runit.dir>
+                  </properties>
+                </configuration>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+      <properties>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
+        <jruby.version>10.1.1.0</jruby.version>
+        <jruby.versions>10.1.1.0</jruby.versions>
+      </properties>
+    </profile>
+    <profile>
+      <id>test-10.1.2.0</id>
+      <build>
+        <plugins>
+          <plugin>
+            <artifactId>maven-invoker-plugin</artifactId>
+            <version>3.8.1</version>
+            <executions>
+              <execution>
+                <goals>
+                  <goal>install</goal>
+                  <goal>run</goal>
+                </goals>
+                <configuration>
+                  <projectsDirectory>src/it</projectsDirectory>
+                  <pomIncludes>
+                    <pomInclude>*/pom.xml</pomInclude>
+                  </pomIncludes>
+                  <streamLogs>true</streamLogs>
+                  <properties>
+                    <jruby.versions>${jruby.versions}</jruby.versions>
+                    <jruby.openssl.version>${project.version}</jruby.openssl.version>
+                    <bc.versions>${bc.versions}</bc.versions>
+                    <runit.dir>${runit.dir}</runit.dir>
+                  </properties>
+                </configuration>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+      <properties>
+        <bc.versions>1.80,1.81,1.82,1.83,1.84,1.85,1.86</bc.versions>
+        <jruby.version>10.1.2.0</jruby.version>
+        <jruby.versions>10.1.2.0</jruby.versions>
+      </properties>
+    </profile>
     <profile>
       <id>release</id>
       <build>
@@ -940,6 +1051,7 @@ DO NOT MODIFY - GENERATED CODE
                         <include>org/jruby/ext/openssl/SecurityHelper.java</include>
                         <include>org/jruby/ext/openssl/SimpleSecretKey.java</include>
                         <include>org/jruby/ext/openssl/StringHelper.java</include>
+                        <include>org/jruby/ext/openssl/Timestamp.java</include>
                         <include>org/jruby/ext/openssl/X509.java</include>
                         <include>org/jruby/ext/openssl/X509Attribute.java</include>
                         <include>org/jruby/ext/openssl/X509CRL.java</include>
@@ -983,6 +1095,7 @@ DO NOT MODIFY - GENERATED CODE
                         <include>org/jruby/ext/openssl/impl/PKCS7DataDigest.java</include>
                         <include>org/jruby/ext/openssl/impl/PKCS7DataEncrypted.java</include>
                         <include>org/jruby/ext/openssl/impl/PKCS7DataEnveloped.java</include>
+                        <include>org/jruby/ext/openssl/impl/PKCS7DataOther.java</include>
                         <include>org/jruby/ext/openssl/impl/PKCS7DataSigned.java</include>
                         <include>org/jruby/ext/openssl/impl/PKCS7DataSignedAndEnveloped.java</include>
                         <include>org/jruby/ext/openssl/impl/PKCS7Exception.java</include>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jruby-openssl
 version: !ruby/object:Gem::Version
-  version: 0.19.1
+  version: 0.19.3
 platform: java
 authors:
 - Karol Bucek
@@ -9,7 +9,7 @@ authors:
 - JRuby contributors
 bindir: bin
 cert_chain: []
-date: 2026-09-01 00:00:00.000000000 Z
+date: 2026-10-07 00:00:00.000000000 Z
 dependencies: []
 description: Ruby OpenSSL compatibility for JRuby, based on Java JCA/JCE and Bouncy
   Castle libraries (does not depend on native OpenSSL).
@@ -40,10 +40,10 @@ files:
 - lib/openssl/ssl.rb
 - lib/openssl/x509.rb
 - pom.xml
-- vendor/org/bouncycastle/bcpkix-jdk18on/1.85/bcpkix-jdk18on-1.85.jar
-- vendor/org/bouncycastle/bcprov-jdk18on/1.85.2/bcprov-jdk18on-1.85.2.jar
-- vendor/org/bouncycastle/bctls-jdk18on/1.85/bctls-jdk18on-1.85.jar
-- vendor/org/bouncycastle/bcutil-jdk18on/1.85/bcutil-jdk18on-1.85.jar
+- vendor/org/bouncycastle/bcpkix-jdk18on/1.86/bcpkix-jdk18on-1.86.jar
+- vendor/org/bouncycastle/bcprov-jdk18on/1.86/bcprov-jdk18on-1.86.jar
+- vendor/org/bouncycastle/bctls-jdk18on/1.86.1/bctls-jdk18on-1.86.1.jar
+- vendor/org/bouncycastle/bcutil-jdk18on/1.86/bcutil-jdk18on-1.86.jar
 licenses:
 - EPL-1.0
 - GPL-2.0
@@ -67,10 +67,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements:
-- jar org.bouncycastle:bcprov-jdk18on, [1.80,1.85.2]
-- jar org.bouncycastle:bcpkix-jdk18on, [1.80,1.85]
-- jar org.bouncycastle:bctls-jdk18on,  [1.80,1.85]
-- jar org.bouncycastle:bcutil-jdk18on, [1.80,1.85]
+- jar org.bouncycastle:bcprov-jdk18on, [1.80,1.86]
+- jar org.bouncycastle:bcpkix-jdk18on, [1.80,1.86]
+- jar org.bouncycastle:bctls-jdk18on,  [1.80,1.86.1]
+- jar org.bouncycastle:bcutil-jdk18on, [1.80,1.86]
 rubygems_version: 3.6.3
 specification_version: 4
 summary: SSL/TLS and general-purpose cryptography for JRuby