Notes on jdk.certpath.disabledAlgorithms

[Brent Putman]

On 1/23/17 3:17 PM, Tom Zeller wrote:
> TL;DR We (meaning Brent) should just fix the test certs.

Yes.  I already opened a ticket about it last Wed so I wouldn't forget: 
https://issues.shibboleth.net/jira/browse/OSJ-192


>
> On last Friday’s dev call, we talked about the couple of OpenSAML tests[1] that are failing after the OpenJDK update which included MD5 in jdk.certpath.disabledAlgorithms. The real fix is, as Brent said, to remove/replace the test certs with MD5 signatures. However, as a temporary solution, I looked at enabling MD5 just for the failing tests. The only way I see to enable MD5 for the tests is via the <argLine/> configuration of the maven-surefire-plugin (which is what runs the tests), specifically :
>
>
>         <argLine>-Djava.security.properties=${project.basedir}/java.security-overrides</argLine> 

That works, but as I mentioned somewhere else (where?), that's probably
sub-optimal b/c we then have to keep that file updated with any
new/changed stuff going forward, and/or the tests would no longer
function as a canary to whatever stuff they change wrt the JRE defaults
in the future..


>
> I was not able to set jdk.certpath.disabledAlgorithms as a system property (i.e. -D), I don’t see any doc that that should work.

That was my recollection also.  I'll address Scott's comment in the
other msg in this thread.


>
> Also, calling Security.setProperty() in the test itself via @BeforeClass didn’t work either, I guess because those security properties were instantiated already, I don’t know.

Hmm, it may only read them once, or something.  Might have better luck
with @BeforeSuite, but probably isn't worth messing with.  Hopefully I
can just fix the tests soon. I'll try this week, if I can hunt down my
cmd line openssl CA scripts.


>
> Thing is, we already override the maven-surefire-plugin <argLine/> in the parent-v3 POM for Cobertura, and the <argLine/>s are not additive, so the Maven configuration will get messier for Java 7. Not a huge deal, but I'd rather start building with Java 8 (keeping -source and -target at 1.7 and adding -Xbootclaspath, would take a little work to make sure we get it right).

That all does sound particularly nasty.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170123/7d63e4c4/attachment.html>