jruby-openssl 0.19.2-java → 0.19.3-java

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 333ea31e2b8e97fe3952c679a5c7e4518d5044bb4022015db9307481ee1a8bb8
-  data.tar.gz: 7439667603e352d2158e3778e9060664c94e529cb2c205578613169b7cea45e8
+  metadata.gz: 4b2d2e2cfb98fb276169353e0a96ef2c41b5ed9be72afe65f8a533f2af389303
+  data.tar.gz: 56891904f7804768cdf31d8a10f7f86c91ef1a1a86119d297648fb9b293a9f1e
 SHA512:
-  metadata.gz: 636424c4fe4bd18e956cdb93e6c4cf9397531b5cc3d5c56d791a3759a036f2848ded320fee858a18516d3010f2d2cffab567fde6e7186ec3fa3a60def96f9451
-  data.tar.gz: d5520d35c471b83aaf32b64fa534f7268d2b6d0d6873289cf28286eb35bdf3c4f41546d4ee46674c449c8d92d238d5f5d490d70409bfb8b0db3615d495aae1c1
+  metadata.gz: 898da59071f4969cd053072d181954355a668e9fd5011c9b099287bc899e24525e73ff1b8a43efc00a8fd9ca06bcc20e5293e0fc734379863bb62957d4412447
+  data.tar.gz: 58fe61d22c8346b07b27acce29b7aa8fb489e603e2aededac65f94fc05dcf51e6e788af5ae8473c59bf0470539e07e541fcd3dda823f1bbd370f48ed016e9462

data/History.md

@@ -1,3 +1,32 @@
+## 0.19.3
+
+Broader OpenSSL compatibility across PKCS7, X.509, key handling and big numbers,
+with new DH validation and digest enumeration support.
+
+- [feat] implement `Digest.digests` algorithm enumeration
+- [feat] add `PKey::DH#params_ok?` parameter validation
+- [compat] add `PKey::DH#public_key`
+- [feat] add EC `on_curve?` checks and hybrid point serialization
+- [compat] align PKCS7 behavior with OpenSSL
+- [compat] align PKCS12 MAC handling (PKCS12KDF & PBMAC1) with OpenSSL
+- [compat] support configured X.509 extensions
+- [compat] load X.509 certificate chains
+- [compat] support multiple CRL distribution point URIs
+- [compat] format X.509 names like OpenSSL
+- [compat] validate X.509 attribute values
+- [compat] suppress X.509 store callback exceptions
+- [compat] parse DER certificates before trying PEM
+- [compat] align Netscape SPKI serialization with OpenSSL
+- [compat] align OCSP signing with OpenSSL
+- [compat] align BN modular arithmetic and negative string conversion
+- [compat] raise `BNError` for invalid arithmetic
+- [compat] reject `nil` BN values
+- [compat] map invalid X.509 extension values to `ExtensionError`
+- [compat] copy X.509 collection arguments to avoid retaining caller-owned arrays
+- [fix] format zero BN as single hex digit
+- [fix] report BouncyCastle `SecureRandom` initialization errors
+- [fix] reset TLS output buffer after shutdown
+
 ## 0.19.2
 
 ASN.1 and X.509 compatibility improvements, new OpenSSL::Timestamp support & 

data/README.md

@@ -85,9 +85,13 @@ Bouncy Castle libraries, so some entry points are unavailable, behave differentl
 
 **SSL / TLS** (backed by JSSE)
 - `SSLSocket#state` and NPN (`#npn_protocol`) are unimplemented and return `nil` - use ALPN instead
+- `SSLSocket#close_write` closes both TLS directions even on TLS 1.3; reading a peer response afterward 
+  is unsupported, use message lengths or delimiters to frame requests instead of TLS EOF 
+  NOTE: that you can enforce the half-close when using the JDK built-in SunJSSE provider
 - Forced session resumption (`SSLSocket#session=`) is best-effort and only fully works with the
   BouncyCastle JSSE provider; `session_reused?` may return `nil` ("can't decide")
-- `SSL::Session#id=` / `#time=` are no-ops; `SSL::Session.new` on a non-socket raises `NotImplementedError`
+- `SSL::Session#id=` / `#time=` are no-ops 
+- `SSL::Session.new` on a non-socket raises `NotImplementedError`
 - Hostname / `subjectAltName` matching runs over Java's certificate parsing and can differ from
   MRI's `GeneralName` handling in edge cases
 
@@ -99,9 +103,8 @@ Bouncy Castle libraries, so some entry points are unavailable, behave differentl
 
 **PKey** (EC / DH / EdDSA)
 - EC is limited to prime curves (`:GFp`); binary-field curves (`:GF2m`) fail
-- `EC::Point#mul` with array arguments, `:hybrid` point compression, and encrypted EC private-key
-  export are not implemented
-- `DH#set_pqg` accepts but silently ignores the `q` parameter
+- `EC::Point#mul` with array arguments and encrypted EC private-key export are not implemented
+- `DH#set_pqg` ignores the `q` parameter (and warns when it is non-`nil`)
 - EdDSA (`Ed25519` / `Ed448`) rejects digest arguments
 
 **X509**

data/Rakefile

@@ -95,6 +95,9 @@ task :test => ['lib/jopenssl.jar', 'pkg/test-classes/org/jruby/ext/openssl/Secur
 require_relative 'tasks/vendor_tests'
 define_vendor_test_tasks # root + jopenssl_lib default to this tree
 
+require_relative 'tasks/mri_tests'
+define_mri_test_task
+
 require_relative 'tasks/provider_tests'
 namespace :test do
   namespace :provider do

data/lib/jopenssl/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module JOpenSSL
-  VERSION = '0.19.2'
+  VERSION = '0.19.3'
   BOUNCY_CASTLE_VERSION = '1.86'
 
   # @private

data/lib/openssl/ssl.rb

@@ -489,6 +489,8 @@ YoaOffgTf5qxiwkjnlVZQc3whgnEt9FpVMvQ9eknyeGB5KHfayAc3+hUAvI3/Cr3
       # Therefore, on TLS 1.2, this method will cause the connection to be
       # completely shut down. On TLS 1.3, the connection will remain open for
       # reading only.
+      #
+      # NOTE: JRuby, when using BC-JSSE, closes both directions even on TLS 1.3
       def close_write
         stop
       end

data/lib/openssl/x509.rb

@@ -135,19 +135,19 @@ module OpenSSL
             raise ASN1::ASN1Error, "invalid extension"
           end
 
-          crl_uris = cdp_asn1.map do |crl_distribution_point|
+          crl_uris = cdp_asn1.flat_map do |crl_distribution_point|
             distribution_point = crl_distribution_point.value.find do |v|
               v.tag_class == :CONTEXT_SPECIFIC && v.tag == 0
             end
             full_name = distribution_point&.value&.find do |v|
               v.tag_class == :CONTEXT_SPECIFIC && v.tag == 0
             end
-            full_name&.value&.find do |v|
+            full_name&.value&.select do |v|
               v.tag_class == :CONTEXT_SPECIFIC && v.tag == 6 # uniformResourceIdentifier
             end
           end
 
-          crl_uris&.map(&:value)
+          crl_uris.empty? ? nil : crl_uris.map(&:value)
         end
       end
 

data/pom.xml

@@ -11,7 +11,7 @@ DO NOT MODIFY - GENERATED CODE
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.jruby.openssl</groupId>
   <artifactId>jruby-openssl</artifactId>
-  <version>0.19.2</version>
+  <version>0.19.3</version>
   <packaging>gem</packaging>
   <name>SSL/TLS and general-purpose cryptography for JRuby</name>
   <description>Ruby OpenSSL compatibility for JRuby, based on Java JCA/JCE and Bouncy Castle libraries (does not depend on native OpenSSL).</description>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jruby-openssl
 version: !ruby/object:Gem::Version
-  version: 0.19.2
+  version: 0.19.3
 platform: java
 authors:
 - Karol Bucek
@@ -9,7 +9,7 @@ authors:
 - JRuby contributors
 bindir: bin
 cert_chain: []
-date: 2026-09-25 00:00:00.000000000 Z
+date: 2026-10-07 00:00:00.000000000 Z
 dependencies: []
 description: Ruby OpenSSL compatibility for JRuby, based on Java JCA/JCE and Bouncy
   Castle libraries (does not depend on native OpenSSL).