jruby-openssl 0.19.2-java → 0.19.4-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 333ea31e2b8e97fe3952c679a5c7e4518d5044bb4022015db9307481ee1a8bb8
-  data.tar.gz: 7439667603e352d2158e3778e9060664c94e529cb2c205578613169b7cea45e8
+  metadata.gz: 5bb2aa94792608481396a74fa230379ae8316e9dc58d5752680001bbb6e01999
+  data.tar.gz: 9de9c267a793e3fb3d0eadcdb5517917df1240b9c67a69538c51071ff439ed16
 SHA512:
-  metadata.gz: 636424c4fe4bd18e956cdb93e6c4cf9397531b5cc3d5c56d791a3759a036f2848ded320fee858a18516d3010f2d2cffab567fde6e7186ec3fa3a60def96f9451
-  data.tar.gz: d5520d35c471b83aaf32b64fa534f7268d2b6d0d6873289cf28286eb35bdf3c4f41546d4ee46674c449c8d92d238d5f5d490d70409bfb8b0db3615d495aae1c1
+  metadata.gz: 3fa4d17673050c372774ac8fd44513e21124eea59b82d2b46896ddb9d8ccc52a811502fbb4c1d3c4d06290d3e5f97f0fa798c243f039c2ff0ca5c1596b134f33
+  data.tar.gz: d0b29d49eeb671d47e8e11a463214e17a10c43be969dd4130e6e5c65046ae5bc683e33e35a5b4afd3f59f1a2e88e7dd8d9c27060c6495caa9259270bd8baaaa2

data/History.md

@@ -1,3 +1,47 @@
+## 0.19.4
+
+TLS compatibility, cipher selection and key-handling (regression) fixes.
+
+- [fix] match BCJSSE credential key in TLS handshakes (#383)
+- [fix] keep CTR (and OFB) cipher state after final (#392)
+- [fix] report 1.3 ciphers independently of legacy selectors
+- [fix] support AES128, AES256 and CHACHA20 cipher aliases (#390)
+- [fix] translate unchecked RSA provider errors
+- [fix] return `false` for out-of-range RSA-PSS signatures
+- [fix] finalize buffered TLS EOF handling (#388)
+- [fix] deliver buffered data before EOF (#388)
+- [fix] support ECDHE cipher selectors (#387)
+- [fix] reject incomplete PEM end markers (#385)
+
+## 0.19.3
+
+Broader OpenSSL compatibility across PKCS7, X.509, key handling and big numbers,
+with new DH validation and digest enumeration support.
+
+- [feat] implement `Digest.digests` algorithm enumeration
+- [feat] add `PKey::DH#params_ok?` parameter validation
+- [compat] add `PKey::DH#public_key`
+- [feat] add EC `on_curve?` checks and hybrid point serialization
+- [compat] align PKCS7 behavior with OpenSSL
+- [compat] align PKCS12 MAC handling (PKCS12KDF & PBMAC1) with OpenSSL
+- [compat] support configured X.509 extensions
+- [compat] load X.509 certificate chains
+- [compat] support multiple CRL distribution point URIs
+- [compat] format X.509 names like OpenSSL
+- [compat] validate X.509 attribute values
+- [compat] suppress X.509 store callback exceptions
+- [compat] parse DER certificates before trying PEM
+- [compat] align Netscape SPKI serialization with OpenSSL
+- [compat] align OCSP signing with OpenSSL
+- [compat] align BN modular arithmetic and negative string conversion
+- [compat] raise `BNError` for invalid arithmetic
+- [compat] reject `nil` BN values
+- [compat] map invalid X.509 extension values to `ExtensionError`
+- [compat] copy X.509 collection arguments to avoid retaining caller-owned arrays
+- [fix] format zero BN as single hex digit
+- [fix] report BouncyCastle `SecureRandom` initialization errors
+- [fix] reset TLS output buffer after shutdown
+
 ## 0.19.2
 
 ASN.1 and X.509 compatibility improvements, new OpenSSL::Timestamp support & 

data/README.md

@@ -85,9 +85,13 @@ Bouncy Castle libraries, so some entry points are unavailable, behave differentl
 
 **SSL / TLS** (backed by JSSE)
 - `SSLSocket#state` and NPN (`#npn_protocol`) are unimplemented and return `nil` - use ALPN instead
+- `SSLSocket#close_write` closes both TLS directions even on TLS 1.3; reading a peer response afterward 
+  is unsupported, use message lengths or delimiters to frame requests instead of TLS EOF 
+  NOTE: that you can enforce the half-close when using the JDK built-in SunJSSE provider
 - Forced session resumption (`SSLSocket#session=`) is best-effort and only fully works with the
   BouncyCastle JSSE provider; `session_reused?` may return `nil` ("can't decide")
-- `SSL::Session#id=` / `#time=` are no-ops; `SSL::Session.new` on a non-socket raises `NotImplementedError`
+- `SSL::Session#id=` / `#time=` are no-ops 
+- `SSL::Session.new` on a non-socket raises `NotImplementedError`
 - Hostname / `subjectAltName` matching runs over Java's certificate parsing and can differ from
   MRI's `GeneralName` handling in edge cases
 
@@ -99,9 +103,8 @@ Bouncy Castle libraries, so some entry points are unavailable, behave differentl
 
 **PKey** (EC / DH / EdDSA)
 - EC is limited to prime curves (`:GFp`); binary-field curves (`:GF2m`) fail
-- `EC::Point#mul` with array arguments, `:hybrid` point compression, and encrypted EC private-key
-  export are not implemented
-- `DH#set_pqg` accepts but silently ignores the `q` parameter
+- `EC::Point#mul` with array arguments and encrypted EC private-key export are not implemented
+- `DH#set_pqg` ignores the `q` parameter (and warns when it is non-`nil`)
 - EdDSA (`Ed25519` / `Ed448`) rejects digest arguments
 
 **X509**

data/Rakefile

@@ -95,21 +95,25 @@ task :test => ['lib/jopenssl.jar', 'pkg/test-classes/org/jruby/ext/openssl/Secur
 require_relative 'tasks/vendor_tests'
 define_vendor_test_tasks # root + jopenssl_lib default to this tree
 
+require_relative 'tasks/mri_tests'
+define_mri_test_task
+
 require_relative 'tasks/provider_tests'
 namespace :test do
   namespace :provider do
     define_provider_test_task :bc_all,
-                              description: 'Run tests with BC providers registered through java.security',
+                              description: 'Run tests with BC providers registered',
                               providers: [
                                 { name: 'BC', class: 'org.bouncycastle.jce.provider.BouncyCastleProvider' },
                                 { name: 'BCJSSE', class: 'org.bouncycastle.jsse.provider.BouncyCastleJsseProvider' }
                               ],
                               jars: -> { FileList['vendor/**/*.jar'].map { |path| File.expand_path(path) } }
-    define_provider_test_task :bc_wout_jsse,
-                              description: 'Run tests with only BC provider registered (without BC-JSSE)',
+    define_provider_test_task :bc_wout_jsse, # BC registered but BC-JSSE n/a
+                              description: 'Run tests with BC provider and default SSL engine',
                               providers: [
                                 { name: 'BC', class: 'org.bouncycastle.jce.provider.BouncyCastleProvider' },
                               ],
+                              extra_ruby_opts: ['-J-Djruby.openssl.provider.ssl=false'], # use built-in SunJSSE
                               jdk_providers: ['SUN', 'SunJSSE', 'SunJCE', 'SunEC'],
                               jars: -> { FileList['vendor/**/*.jar'].map { |path| File.expand_path(path) } }
   end

data/lib/jopenssl/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module JOpenSSL
-  VERSION = '0.19.2'
+  VERSION = '0.19.4'
   BOUNCY_CASTLE_VERSION = '1.86'
 
   # @private

data/lib/openssl/ssl.rb

@@ -489,6 +489,8 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
       # Therefore, on TLS 1.2, this method will cause the connection to be
       # completely shut down. On TLS 1.3, the connection will remain open for
       # reading only.
+      #
+      # NOTE: JRuby, when using BC-JSSE, closes both directions even on TLS 1.3
       def close_write
         stop
       end

data/lib/openssl/x509.rb

@@ -135,19 +135,19 @@ module OpenSSL
             raise ASN1::ASN1Error, "invalid extension"
           end
 
-          crl_uris = cdp_asn1.map do |crl_distribution_point|
+          crl_uris = cdp_asn1.flat_map do |crl_distribution_point|
             distribution_point = crl_distribution_point.value.find do |v|
               v.tag_class == :CONTEXT_SPECIFIC && v.tag == 0
             end
             full_name = distribution_point&.value&.find do |v|
               v.tag_class == :CONTEXT_SPECIFIC && v.tag == 0
             end
-            full_name&.value&.find do |v|
+            full_name&.value&.select do |v|
               v.tag_class == :CONTEXT_SPECIFIC && v.tag == 6 # uniformResourceIdentifier
             end
           end
 
-          crl_uris&.map(&:value)
+          crl_uris.empty? ? nil : crl_uris.map(&:value)
         end
       end
 

data/pom.xml

@@ -11,7 +11,7 @@ DO NOT MODIFY - GENERATED CODE
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.jruby.openssl</groupId>
   <artifactId>jruby-openssl</artifactId>
-  <version>0.19.2</version>
+  <version>0.19.4</version>
   <packaging>gem</packaging>
   <name>SSL/TLS and general-purpose cryptography for JRuby</name>
   <description>Ruby OpenSSL compatibility for JRuby, based on Java JCA/JCE and Bouncy Castle libraries (does not depend on native OpenSSL).</description>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jruby-openssl
 version: !ruby/object:Gem::Version
-  version: 0.19.2
+  version: 0.19.4
 platform: java
 authors:
 - Karol Bucek
@@ -9,7 +9,7 @@ authors:
 - JRuby contributors
 bindir: bin
 cert_chain: []
-date: 2026-09-25 00:00:00.000000000 Z
+date: 2026-10-27 00:00:00.000000000 Z
 dependencies: []
 description: Ruby OpenSSL compatibility for JRuby, based on Java JCA/JCE and Bouncy
   Castle libraries (does not depend on native OpenSSL).