[java-identity-provider] branch main updated: JPAR-205 - Update Bouncy Castle components
Ian Young
ian at iay.org.uk
Thu Jan 5 16:11:21 UTC 2023
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch main
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=5a18b173b2276f4c4a684f2a1a5a49f8787a2dea
The following commit(s) were added to refs/heads/main by this push:
new 5a18b173b JPAR-205 - Update Bouncy Castle components
5a18b173b is described below
commit 5a18b173b2276f4c4a684f2a1a5a49f8787a2dea
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Wed Dec 21 14:39:29 2022 +0000
JPAR-205 - Update Bouncy Castle components
https://shibboleth.atlassian.net/browse/JPAR-205
---
idp-distribution/pom.xml | 6 +-
idp-installer/pom.xml | 4 +-
.../idp/installer/plugin/impl/TrustStore.java | 65 +++++++++-------------
idp-parent/pom.xml | 4 ++
4 files changed, 34 insertions(+), 45 deletions(-)
diff --git a/idp-distribution/pom.xml b/idp-distribution/pom.xml
index 89001079d..36aa1b55a 100644
--- a/idp-distribution/pom.xml
+++ b/idp-distribution/pom.xml
@@ -57,7 +57,7 @@
<!-- Required if you're using casses from the security package. -->
<dependency>
<groupId>org.bouncycastle</groupId>
- <artifactId>bcpkix-jdk15on</artifactId>
+ <artifactId>bcpkix-jdk18on</artifactId>
<optional>true</optional>
<scope>runtime</scope>
</dependency>
@@ -65,7 +65,7 @@
<!-- For the installers -->
<dependency>
<groupId>org.bouncycastle</groupId>
- <artifactId>bcpg-jdk15on</artifactId>
+ <artifactId>bcpg-jdk18on</artifactId>
<scope>runtime</scope>
</dependency>
@@ -208,7 +208,7 @@
</artifactItem>
<artifactItem>
<groupId>org.bouncycastle</groupId>
- <artifactId>bcpg-jdk15on</artifactId>
+ <artifactId>bcpg-jdk18on</artifactId>
</artifactItem>
<artifactItem>
<groupId>org.apache.commons</groupId>
diff --git a/idp-installer/pom.xml b/idp-installer/pom.xml
index 3d65931f9..39132e4b4 100644
--- a/idp-installer/pom.xml
+++ b/idp-installer/pom.xml
@@ -89,12 +89,12 @@
<dependency>
<groupId>org.bouncycastle</groupId>
- <artifactId>bcpg-jdk15on</artifactId>
+ <artifactId>bcpg-jdk18on</artifactId>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
- <artifactId>bcprov-jdk15on</artifactId>
+ <artifactId>bcprov-jdk18on</artifactId>
<scope>provided</scope>
</dependency>
diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/TrustStore.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/TrustStore.java
index d818fe1fb..c8cd8718d 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/TrustStore.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/TrustStore.java
@@ -131,8 +131,6 @@ import net.shibboleth.shared.component.ComponentInitializationException;
pgpFact = new PGPObjectFactory(decoded, new JcaKeyFingerprintCalculator());
}
return new PGPPublicKeyRingCollection(listr);
- } catch (final PGPException e) {
- throw new IOException("Error reading key ring", e);
}
}
@@ -155,11 +153,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
* has problems.
*/
protected void createNewStore() throws IOException {
- try {
- keyRings = new PGPPublicKeyRingCollection(Collections.emptyList());
- } catch (final PGPException e) {
- throw new IOException("Bad keystore", e);
- }
+ keyRings = new PGPPublicKeyRingCollection(Collections.emptyList());
saveStoreInternal();
}
@@ -214,34 +208,30 @@ import net.shibboleth.shared.component.ComponentInitializationException;
final Predicate<String> accept) throws IOException {
final PGPPublicKeyRingCollection providedStore = loadStoreFrom(keyStream);
- try {
- final PGPPublicKey key = providedStore.getPublicKey(sigForKey.getSignature().getKeyID());
- if (key == null) {
- log.info("Provided key stream did not contain a key for {}", sigForKey);
- return;
- }
- final StringBuilder builder = new StringBuilder("Signature:\t").
- append(sigForKey.toString()).
- append("\nFingerPrint:\t").
- append((new String(Hex.encode(key.getFingerprint()))).toUpperCase());
- final Iterator<String> namesIterator = key.getUserIDs();
- while (namesIterator.hasNext()) {
- builder.append("\nUsername:\t").append(namesIterator.next());
- }
- builder.append('\n');
- final String keyInfo = builder.toString();
- log.debug("Asking to import key\n{}", keyInfo);
- if (!accept.test(keyInfo)) {
- log.info("Key import barred by user");
- return;
- }
- keyRings = PGPPublicKeyRingCollection.addPublicKeyRing(
- keyRings,
- new PGPPublicKeyRing(Collections.singletonList(key)));
- saveStoreInternal();
- } catch (final PGPException e) {
- log.warn("Couldn't locate key", e);
+ final PGPPublicKey key = providedStore.getPublicKey(sigForKey.getSignature().getKeyID());
+ if (key == null) {
+ log.info("Provided key stream did not contain a key for {}", sigForKey);
+ return;
}
+ final StringBuilder builder = new StringBuilder("Signature:\t").
+ append(sigForKey.toString()).
+ append("\nFingerPrint:\t").
+ append((new String(Hex.encode(key.getFingerprint()))).toUpperCase());
+ final Iterator<String> namesIterator = key.getUserIDs();
+ while (namesIterator.hasNext()) {
+ builder.append("\nUsername:\t").append(namesIterator.next());
+ }
+ builder.append('\n');
+ final String keyInfo = builder.toString();
+ log.debug("Asking to import key\n{}", keyInfo);
+ if (!accept.test(keyInfo)) {
+ log.info("Key import barred by user");
+ return;
+ }
+ keyRings = PGPPublicKeyRingCollection.addPublicKeyRing(
+ keyRings,
+ new PGPPublicKeyRing(Collections.singletonList(key)));
+ saveStoreInternal();
}
/** Provide an opaque signature object from an input stream.
@@ -263,12 +253,7 @@ import net.shibboleth.shared.component.ComponentInitializationException;
log.debug("Looking for key with Id {}", signature);
- try {
- return keyRings.getPublicKey(sig.getKeyID()) != null;
- } catch (final PGPException e) {
- log.warn("Error looking for key {}", signature, e);
- return false;
- }
+ return keyRings.getPublicKey(sig.getKeyID()) != null;
}
/** Run a signature check over the streams.
diff --git a/idp-parent/pom.xml b/idp-parent/pom.xml
index 8b23d0d31..b8b34cd95 100644
--- a/idp-parent/pom.xml
+++ b/idp-parent/pom.xml
@@ -256,6 +256,10 @@
<exclude>javax.mail:mail</exclude>
<exclude>javax.xml.bind:jaxb-api</exclude>
<exclude>com.sun.mail:javax.mail</exclude>
+ <!--
+ Ban use of older coordinates for Bouncy Castle components.
+ -->
+ <exclude>org.bouncycastle:*-jdk15on</exclude>
</excludes>
<includes>
<!--
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list