jruby-openssl 0.19.0-java → 0.19.1-java
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/History.md +43 -0
- data/Rakefile +43 -7
- data/lib/jopenssl/load.rb +10 -8
- data/lib/jopenssl/version.rb +12 -1
- data/lib/jopenssl.jar +0 -0
- data/pom.xml +4 -5
- data/vendor/org/bouncycastle/bcprov-jdk18on/{1.85/bcprov-jdk18on-1.85.jar → 1.85.2/bcprov-jdk18on-1.85.2.jar} +0 -0
- metadata +4 -4
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: d303c479c506753df7b876af7963e7eea17311aff21f7830deab8fb406a99e85
|
|
4
|
+
data.tar.gz: 24f04a2d978a80711b6271e748068037ad8b4ce4b0f2607ba57aab283c7d980d
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 43e9318c7276016bec340d935b6e78b019c6a1959cbed2c5b0f2545617618b84e6da586d83291a5dd55d9609d2534fe051228a8af99104e8e96d85054c53e025
|
|
7
|
+
data.tar.gz: caabdffeedc0fc4a813be83222cceddfc85d254959f32a81ad9b908a84a3feec977b67628484b7af72f30cbbc3469c44287934d8a0945d8782e147e2dee4e0d7
|
data/History.md
CHANGED
|
@@ -1,3 +1,46 @@
|
|
|
1
|
+
## 0.19.1
|
|
2
|
+
|
|
3
|
+
X25519/X448 key support and DH key reading, and a (final) round of provider
|
|
4
|
+
routing driven by the FIPS variant
|
|
5
|
+
|
|
6
|
+
- [feat] X25519/X448 type `PKey` support
|
|
7
|
+
`PKey.read`, `generate_key` and `new_raw_private/public_key` now handle XDH
|
|
8
|
+
- [feat] read DH keys (not just DH parameters)
|
|
9
|
+
PKCS#8 and SubjectPublicKeyInfo DH keys previously failed to parse
|
|
10
|
+
- [compat] read DH parameters via `OpenSSL::PKey.read`
|
|
11
|
+
- [compat] ASN.1 objects for the RFC 8410 curves
|
|
12
|
+
`ASN1::ObjectId` could not resolve X25519/X448/ED25519/ED448 by name or OID
|
|
13
|
+
- [compat] `PKey#inspect` reporting `oid` and `type_name`
|
|
14
|
+
- [compat] define `OP_NO_RENEGOTIATION` constant
|
|
15
|
+
- [fix] read back DER written by `PKey#to_der`
|
|
16
|
+
`PKey.read` only tried PKCS#8 on DER input
|
|
17
|
+
- [fix] raise `PKeyError` for unsupported public key algorithm
|
|
18
|
+
- [fix] raise `SSLError` on handshake failure in connect (#204)
|
|
19
|
+
JSSE may abort handshake with a plain exception when no protocol is enabled
|
|
20
|
+
- [compat] read and write PKCS12 through Bouncy Castle
|
|
21
|
+
supports OpenSSL 3 PBES2/PBKDF2 encryption and PBMAC1 MACs without JDK KeyStore
|
|
22
|
+
- [compat] honor `PKCS12.create` PBE and iteration arguments
|
|
23
|
+
regular mode writes requested legacy PBE algorithms (FIPS rejects unapproved)
|
|
24
|
+
- [feat] honor configured Java trust store properties
|
|
25
|
+
load explicit `javax.net.ssl.trustStore` using the configured `trustStoreType`,
|
|
26
|
+
`trustStoreProvider` and `trustStorePassword`
|
|
27
|
+
- [deps] bump bcprov artifact to latest patch (1.85.2)
|
|
28
|
+
|
|
29
|
+
### Provider Routing
|
|
30
|
+
|
|
31
|
+
Operations that resolved through JDK security now go to the configured provider.
|
|
32
|
+
|
|
33
|
+
- [fips] pin provider when signing certificates and CRLs
|
|
34
|
+
- [fips] use provider when verifying certificates
|
|
35
|
+
`X509Certificate#verify(PublicKey)` goes to the JDK default and a certificate
|
|
36
|
+
read from a JKS keystore stays a `sun.security.x509.X509CertImpl`
|
|
37
|
+
- [fips] generate DSA keys through provider
|
|
38
|
+
`generate_key!` derived private exponent by hand instead of asking for a key pair
|
|
39
|
+
- [fips] keep cipher policy + OCSP digests on provider
|
|
40
|
+
- [fips] report **fips_mode** based on approved-only
|
|
41
|
+
`OpenSSL.fips_mode` now reports whether FIPS is being *enforced*, as C does;
|
|
42
|
+
`OPENSSL_FIPS` reports whether the build is FIPS-*capable*
|
|
43
|
+
|
|
1
44
|
## 0.19.0
|
|
2
45
|
|
|
3
46
|
FIPS support, distributed as a **separate, dual GPL/commercial artifact**.
|
data/Rakefile
CHANGED
|
@@ -25,16 +25,17 @@ task :clean do
|
|
|
25
25
|
sh("#{mvnw} clean")
|
|
26
26
|
end
|
|
27
27
|
|
|
28
|
-
task :
|
|
28
|
+
task :build_release do
|
|
29
29
|
source_date_epoch!
|
|
30
|
-
sh("#{mvnw} -Prelease -DupdateReleaseInfo=true #{_build_output_timestamp}
|
|
30
|
+
sh("#{mvnw} -Prelease -DupdateReleaseInfo=true #{_build_output_timestamp} package")
|
|
31
31
|
end
|
|
32
32
|
|
|
33
|
-
desc "Sanity-check
|
|
33
|
+
desc "Sanity-check tree/version, then build a reproducible release gem"
|
|
34
34
|
task :release => :release_check do
|
|
35
35
|
source_date_epoch! # pin to the release commit so the gem + jar use the same
|
|
36
36
|
puts "SOURCE_DATE_EPOCH=#{ENV['SOURCE_DATE_EPOCH']} (#{Time.at(ENV['SOURCE_DATE_EPOCH'].to_i).utc})"
|
|
37
|
-
Rake::Task[:
|
|
37
|
+
Rake::Task[:clean].invoke
|
|
38
|
+
Rake::Task[:build_release].invoke
|
|
38
39
|
gem = Dir['target/*.gem', 'pkg/*.gem'].max_by { |f| File.mtime(f) }
|
|
39
40
|
abort "release aborted - no .gem produced" unless gem
|
|
40
41
|
puts "built #{gem}"
|
|
@@ -55,8 +56,12 @@ task :release_check do
|
|
|
55
56
|
branch = `git rev-parse --abbrev-ref HEAD`.strip
|
|
56
57
|
warn "WARNING: releasing from '#{branch}' (not 'master')" unless branch == 'master'
|
|
57
58
|
|
|
58
|
-
|
|
59
|
-
|
|
59
|
+
expected_tag = "v#{version}" # release tags are vX.Y.Z
|
|
60
|
+
tags = `git tag --points-at HEAD`.split("\n")
|
|
61
|
+
unless tags.include?(expected_tag)
|
|
62
|
+
found = tags.empty? ? 'none' : tags.join(', ')
|
|
63
|
+
warn "WARNING: no #{expected_tag} tag points at HEAD (tags at HEAD: #{found})"
|
|
64
|
+
end
|
|
60
65
|
|
|
61
66
|
puts "release checks passed for #{version}"
|
|
62
67
|
end
|
|
@@ -69,7 +74,7 @@ task :jar_release => :release_check do
|
|
|
69
74
|
# deploy (gpg-sign + push): #{File.basename(mvnw)} deploy -Prelease,jar-release -D...
|
|
70
75
|
end
|
|
71
76
|
|
|
72
|
-
task :default => :
|
|
77
|
+
task :default => :jar
|
|
73
78
|
|
|
74
79
|
file('lib/jopenssl.jar') { Rake::Task[:jar].invoke }
|
|
75
80
|
|
|
@@ -90,6 +95,37 @@ task :test => ['lib/jopenssl.jar', 'pkg/test-classes/org/jruby/ext/openssl/Secur
|
|
|
90
95
|
require_relative 'tasks/vendor_tests'
|
|
91
96
|
define_vendor_test_tasks # root + jopenssl_lib default to this tree
|
|
92
97
|
|
|
98
|
+
require_relative 'tasks/provider_tests'
|
|
99
|
+
namespace :test do
|
|
100
|
+
namespace :provider do
|
|
101
|
+
define_provider_test_task :bc_all,
|
|
102
|
+
description: 'Run tests with BC providers registered through java.security',
|
|
103
|
+
providers: [
|
|
104
|
+
{ name: 'BC', class: 'org.bouncycastle.jce.provider.BouncyCastleProvider' },
|
|
105
|
+
{ name: 'BCJSSE', class: 'org.bouncycastle.jsse.provider.BouncyCastleJsseProvider' }
|
|
106
|
+
],
|
|
107
|
+
jars: -> { FileList['vendor/**/*.jar'].map { |path| File.expand_path(path) } }
|
|
108
|
+
define_provider_test_task :bc_wout_jsse,
|
|
109
|
+
description: 'Run tests with only BC provider registered (without BC-JSSE)',
|
|
110
|
+
providers: [
|
|
111
|
+
{ name: 'BC', class: 'org.bouncycastle.jce.provider.BouncyCastleProvider' },
|
|
112
|
+
],
|
|
113
|
+
jdk_providers: ['SUN', 'SunJSSE', 'SunJCE', 'SunEC'],
|
|
114
|
+
jars: -> { FileList['vendor/**/*.jar'].map { |path| File.expand_path(path) } }
|
|
115
|
+
end
|
|
116
|
+
|
|
117
|
+
desc 'Run regular and provider test suites'
|
|
118
|
+
task :all do
|
|
119
|
+
%w[
|
|
120
|
+
test
|
|
121
|
+
test:provider:bc_all
|
|
122
|
+
test:provider:bc_wout_jsse
|
|
123
|
+
].each do |name|
|
|
124
|
+
Rake::Task[name].invoke
|
|
125
|
+
end
|
|
126
|
+
end
|
|
127
|
+
end
|
|
128
|
+
|
|
93
129
|
namespace :integration do
|
|
94
130
|
it_path = File.expand_path('integration', File.dirname(__FILE__))
|
|
95
131
|
task :install do
|
data/lib/jopenssl/load.rb
CHANGED
|
@@ -1,24 +1,26 @@
|
|
|
1
1
|
require_relative 'version'
|
|
2
2
|
|
|
3
3
|
# NOTE: assuming user does pull in BC .jars from somewhere else on the class-path
|
|
4
|
-
if ENV_JAVA['jruby.openssl.load.jars'] != 'false' &&
|
|
5
|
-
java.security.Security.getProvider('BC').nil?
|
|
6
|
-
version = JOpenSSL::BOUNCY_CASTLE_VERSION
|
|
4
|
+
if ENV_JAVA['jruby.openssl.load.jars'] != 'false' && java.security.Security.getProvider('BC').nil?
|
|
7
5
|
bc_jars = begin
|
|
8
6
|
require 'jar_dependencies' unless respond_to?(:require_jar, true)
|
|
9
|
-
require_jar 'org.bouncycastle', 'bcprov-jdk18on', version
|
|
10
|
-
require_jar 'org.bouncycastle', 'bcpkix-jdk18on', version
|
|
11
|
-
require_jar 'org.bouncycastle', 'bcutil-jdk18on', version
|
|
12
|
-
require_jar 'org.bouncycastle', 'bctls-jdk18on', version
|
|
7
|
+
require_jar 'org.bouncycastle', 'bcprov-jdk18on', JOpenSSL.version('bcprov-jdk18on')
|
|
8
|
+
require_jar 'org.bouncycastle', 'bcpkix-jdk18on', JOpenSSL.version('bcpkix-jdk18on')
|
|
9
|
+
require_jar 'org.bouncycastle', 'bcutil-jdk18on', JOpenSSL.version('bcutil-jdk18on')
|
|
10
|
+
require_jar 'org.bouncycastle', 'bctls-jdk18on', JOpenSSL.version('bctls-jdk18on')
|
|
13
11
|
true
|
|
14
12
|
rescue LoadError, RuntimeError
|
|
15
13
|
false
|
|
16
14
|
end
|
|
17
15
|
unless bc_jars
|
|
18
|
-
vendor = File.expand_path('../../vendor',
|
|
16
|
+
vendor = File.expand_path('../../vendor', File.dirname(__FILE__))
|
|
17
|
+
version = JOpenSSL.version('bcprov-jdk18on')
|
|
19
18
|
load "#{vendor}/org/bouncycastle/bcprov-jdk18on/#{version}/bcprov-jdk18on-#{version}.jar"
|
|
19
|
+
version = JOpenSSL.version('bcpkix-jdk18on')
|
|
20
20
|
load "#{vendor}/org/bouncycastle/bcpkix-jdk18on/#{version}/bcpkix-jdk18on-#{version}.jar"
|
|
21
|
+
version = JOpenSSL.version('bcutil-jdk18on')
|
|
21
22
|
load "#{vendor}/org/bouncycastle/bcutil-jdk18on/#{version}/bcutil-jdk18on-#{version}.jar"
|
|
23
|
+
version = JOpenSSL.version('bctls-jdk18on')
|
|
22
24
|
load "#{vendor}/org/bouncycastle/bctls-jdk18on/#{version}/bctls-jdk18on-#{version}.jar"
|
|
23
25
|
end
|
|
24
26
|
end
|
data/lib/jopenssl/version.rb
CHANGED
|
@@ -1,5 +1,16 @@
|
|
|
1
1
|
# frozen_string_literal: true
|
|
2
2
|
module JOpenSSL
|
|
3
|
-
VERSION = '0.19.
|
|
3
|
+
VERSION = '0.19.1'
|
|
4
4
|
BOUNCY_CASTLE_VERSION = '1.85'
|
|
5
|
+
|
|
6
|
+
# @private
|
|
7
|
+
BOUNCY_CASTLE_PATCH_VERSIONS = {
|
|
8
|
+
'bcprov-jdk18on' => "#{BOUNCY_CASTLE_VERSION}.2"
|
|
9
|
+
}.freeze
|
|
10
|
+
private_constant :BOUNCY_CASTLE_PATCH_VERSIONS
|
|
11
|
+
|
|
12
|
+
# @private
|
|
13
|
+
def self.version(artifact_id)
|
|
14
|
+
BOUNCY_CASTLE_PATCH_VERSIONS.fetch(artifact_id, BOUNCY_CASTLE_VERSION)
|
|
15
|
+
end
|
|
5
16
|
end
|
data/lib/jopenssl.jar
CHANGED
|
Binary file
|
data/pom.xml
CHANGED
|
@@ -11,7 +11,7 @@ DO NOT MODIFY - GENERATED CODE
|
|
|
11
11
|
<modelVersion>4.0.0</modelVersion>
|
|
12
12
|
<groupId>org.jruby.openssl</groupId>
|
|
13
13
|
<artifactId>jruby-openssl</artifactId>
|
|
14
|
-
<version>0.19.
|
|
14
|
+
<version>0.19.1</version>
|
|
15
15
|
<packaging>gem</packaging>
|
|
16
16
|
<name>SSL/TLS and general-purpose cryptography for JRuby</name>
|
|
17
17
|
<description>Ruby OpenSSL compatibility for JRuby, based on Java JCA/JCE and Bouncy Castle libraries (does not depend on native OpenSSL).</description>
|
|
@@ -75,7 +75,7 @@ DO NOT MODIFY - GENERATED CODE
|
|
|
75
75
|
<dependency>
|
|
76
76
|
<groupId>org.bouncycastle</groupId>
|
|
77
77
|
<artifactId>bcprov-jdk18on</artifactId>
|
|
78
|
-
<version>[1.80,1.85]</version>
|
|
78
|
+
<version>[1.80,1.85.2]</version>
|
|
79
79
|
</dependency>
|
|
80
80
|
<dependency>
|
|
81
81
|
<groupId>org.bouncycastle</groupId>
|
|
@@ -931,6 +931,7 @@ DO NOT MODIFY - GENERATED CODE
|
|
|
931
931
|
<include>org/jruby/ext/openssl/PKeyEdDSA.java</include>
|
|
932
932
|
<include>org/jruby/ext/openssl/PKeyHMAC.java</include>
|
|
933
933
|
<include>org/jruby/ext/openssl/PKeyRSA.java</include>
|
|
934
|
+
<include>org/jruby/ext/openssl/PKeyXDH.java</include>
|
|
934
935
|
<include>org/jruby/ext/openssl/Random.java</include>
|
|
935
936
|
<include>org/jruby/ext/openssl/SSL.java</include>
|
|
936
937
|
<include>org/jruby/ext/openssl/SSLContext.java</include>
|
|
@@ -992,8 +993,6 @@ DO NOT MODIFY - GENERATED CODE
|
|
|
992
993
|
<include>org/jruby/ext/openssl/impl/Signed.java</include>
|
|
993
994
|
<include>org/jruby/ext/openssl/impl/SignerInfoWithPkey.java</include>
|
|
994
995
|
<include>org/jruby/ext/openssl/impl/TypeDiscriminating.java</include>
|
|
995
|
-
<include>org/jruby/ext/openssl/impl/pem/MiscPEMGeneratorHelper.java</include>
|
|
996
|
-
<include>org/jruby/ext/openssl/impl/pem/PEMUtilities.java</include>
|
|
997
996
|
<include>org/jruby/ext/openssl/log/DefaultLogger.java</include>
|
|
998
997
|
<include>org/jruby/ext/openssl/log/JULLogger.java</include>
|
|
999
998
|
<include>org/jruby/ext/openssl/log/Logger.java</include>
|
|
@@ -1002,10 +1001,10 @@ DO NOT MODIFY - GENERATED CODE
|
|
|
1002
1001
|
<include>org/jruby/ext/openssl/shim/CipherShim.java</include>
|
|
1003
1002
|
<include>org/jruby/ext/openssl/shim/ErrorShim.java</include>
|
|
1004
1003
|
<include>org/jruby/ext/openssl/shim/PKeyShim.java</include>
|
|
1004
|
+
<include>org/jruby/ext/openssl/shim/ProviderShim.java</include>
|
|
1005
1005
|
<include>org/jruby/ext/openssl/util/ByteArrayOutputStream.java</include>
|
|
1006
1006
|
<include>org/jruby/ext/openssl/util/Cache.java</include>
|
|
1007
1007
|
<include>org/jruby/ext/openssl/util/ExceptionUtil.java</include>
|
|
1008
|
-
<include>org/jruby/ext/openssl/util/PEMGenerator.java</include>
|
|
1009
1008
|
<include>org/jruby/ext/openssl/util/RubySupport.java</include>
|
|
1010
1009
|
<include>org/jruby/ext/openssl/x509store/CRL.java</include>
|
|
1011
1010
|
<include>org/jruby/ext/openssl/x509store/Certificate.java</include>
|
|
Binary file
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: jruby-openssl
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.19.
|
|
4
|
+
version: 0.19.1
|
|
5
5
|
platform: java
|
|
6
6
|
authors:
|
|
7
7
|
- Karol Bucek
|
|
@@ -9,7 +9,7 @@ authors:
|
|
|
9
9
|
- JRuby contributors
|
|
10
10
|
bindir: bin
|
|
11
11
|
cert_chain: []
|
|
12
|
-
date: 2026-
|
|
12
|
+
date: 2026-09-01 00:00:00.000000000 Z
|
|
13
13
|
dependencies: []
|
|
14
14
|
description: Ruby OpenSSL compatibility for JRuby, based on Java JCA/JCE and Bouncy
|
|
15
15
|
Castle libraries (does not depend on native OpenSSL).
|
|
@@ -41,7 +41,7 @@ files:
|
|
|
41
41
|
- lib/openssl/x509.rb
|
|
42
42
|
- pom.xml
|
|
43
43
|
- vendor/org/bouncycastle/bcpkix-jdk18on/1.85/bcpkix-jdk18on-1.85.jar
|
|
44
|
-
- vendor/org/bouncycastle/bcprov-jdk18on/1.85/bcprov-jdk18on-1.85.jar
|
|
44
|
+
- vendor/org/bouncycastle/bcprov-jdk18on/1.85.2/bcprov-jdk18on-1.85.2.jar
|
|
45
45
|
- vendor/org/bouncycastle/bctls-jdk18on/1.85/bctls-jdk18on-1.85.jar
|
|
46
46
|
- vendor/org/bouncycastle/bcutil-jdk18on/1.85/bcutil-jdk18on-1.85.jar
|
|
47
47
|
licenses:
|
|
@@ -67,7 +67,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
67
67
|
- !ruby/object:Gem::Version
|
|
68
68
|
version: '0'
|
|
69
69
|
requirements:
|
|
70
|
-
- jar org.bouncycastle:bcprov-jdk18on, [1.80,1.85]
|
|
70
|
+
- jar org.bouncycastle:bcprov-jdk18on, [1.80,1.85.2]
|
|
71
71
|
- jar org.bouncycastle:bcpkix-jdk18on, [1.80,1.85]
|
|
72
72
|
- jar org.bouncycastle:bctls-jdk18on, [1.80,1.85]
|
|
73
73
|
- jar org.bouncycastle:bcutil-jdk18on, [1.80,1.85]
|