xmlsectool: binary jar file bails out when the built-from-source version works

[Weiwu Zhang]

Dear developers:

I have a case that caused the binary distribution† of 27-April-2020 to 
throw an exception, while the source code cloned‡ works.

† xmlsectool-2.0.0-bin.zip downloaded from 
http://shibboleth.net/downloads/tools/xmlsectool/2.0.0/

‡ git clone https://git.shibboleth.net/git/xmlsectool

------------------------------------------------------------

First, the exception:

$ JAVA_HOME=/usr/lib/jvm/java-14-openjdk-amd64/ /opt/xmlsectool-2.0.0/xmlsectool.sh --sign --inFile EntryToken.xml --schemaDirectory /home/a/IdeaProjects/TokenScript/schema --signatureAlgorithm http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256 --certificate /home/a/KEYS/aw.app.crt --key /home/a/KEYS/aw.app.key --outFile EntryToken.tsml
INFO  XMLSecTool - Reading XML document from file 'EntryToken.xml'
INFO  XMLSecTool - XML document parsed and is well-formed.
ERROR XMLSecTool - Unknown error
java.lang.IllegalArgumentException: unknown object in getInstance: org.bouncycastle.asn1.ASN1ObjectIdentifier
 	at org.bouncycastle.asn1.ASN1Sequence.getInstance(Unknown Source) ~[bcprov-jdk15on-1.53.jar:1.53.0]
 	at org.bouncycastle.asn1.x9.X9ECParameters.getInstance(Unknown Source) ~[bcprov-jdk15on-1.53.jar:1.53.0]
 	at org.cryptacular.asn.OpenSSLPrivateKeyDecoder.decodeASN1(OpenSSLPrivateKeyDecoder.java:118) ~[cryptacular-1.0.jar:na]
 	at org.cryptacular.asn.OpenSSLPrivateKeyDecoder.decodeASN1(OpenSSLPrivateKeyDecoder.java:31) ~[cryptacular-1.0.jar:na]
 	at org.cryptacular.asn.AbstractPrivateKeyDecoder.decode(AbstractPrivateKeyDecoder.java:26) ~[cryptacular-1.0.jar:na]
 	at org.cryptacular.util.KeyPairUtil.decodePrivateKey(KeyPairUtil.java:423) ~[cryptacular-1.0.jar:na]
 	at org.cryptacular.util.KeyPairUtil.decodePrivateKey(KeyPairUtil.java:388) ~[cryptacular-1.0.jar:na]
 	at org.opensaml.security.crypto.KeySupport.decodePrivateKey(KeySupport.java:223) ~[opensaml-security-api-3.2.0.jar:na]
 	at org.opensaml.security.crypto.KeySupport.decodePrivateKey(KeySupport.java:200) ~[opensaml-security-api-3.2.0.jar:na]
 	at net.shibboleth.tool.xmlsectool.CredentialHelper.getFileBasedCredentials(CredentialHelper.java:79) ~[xmlsectool-2.0.0.jar:na]
 	at net.shibboleth.tool.xmlsectool.XMLSecTool.getCredential(XMLSecTool.java:889) ~[xmlsectool-2.0.0.jar:na]
 	at net.shibboleth.tool.xmlsectool.XMLSecTool.main(XMLSecTool.java:148) ~[xmlsectool-2.0.0.jar:na]

I am not sure what's the trigger, but my guess is that BouncyCastle
didn't recognise the secp256r1 EC key used here.

-----------------------------------------------------------

Then, I built from the source code cloned today, and it works and
produces a seemly valid signed XML file

$ java -classpath /home/a/IdeaProjects/xmlsectool/target/classes:…  net.shibboleth.tool.xmlsectool.XMLSecTool --sign --inFile EntryToken.xml --schemaDirectory /home/a/IdeaProjects/TokenScript/schema --signatureAlgorithm http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256 --certificate /home/a/KEYS/aw.app.crt --key /home/a/KEYS/aw.app.key --outFile EntryToken.tsml
INFO  XMLSecTool - Reading XML document from file 'EntryToken.xml'
INFO  XMLSecTool - XML document parsed and is well-formed.
INFO  XMLSecTool - XML document successfully signed
INFO  XMLSecTool - XML document written to file /home/a/IdeaProjects/TokenScript-Examples/examples/EntryToken/EntryToken.tsml

In the commandline "…" represent the bunch of dependency jar files on
my system†. Most noticablly, the version of BouncyCastle used is 1.64
(compared to the embeded 1.53 brprov which threw up). Could it be the
cause that the binary distribution failed?

--
† In my case,  … are the following
~/.m2/repository/org/slf4j/slf4j-api/1.7.30/slf4j-api-1.7.30.jar
~/.m2/repository/net/shibboleth/utilities/java-support/8.0.0/java-support-8.0.0.jar
~/.m2/repository/com/google/guava/guava/29.0-jre/guava-29.0-jre.jar
~/.m2/repository/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar
~/.m2/repository/com/google/guava/listenablefuture/9999.0-empty-to-avoid-conflict-with-guava/listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
~/.m2/repository/org/checkerframework/checker-qual/2.11.1/checker-qual-2.11.1.jar
~/.m2/repository/com/google/errorprone/error_prone_annotations/2.3.4/error_prone_annotations-2.3.4.jar
~/.m2/repository/com/google/j2objc/j2objc-annotations/1.3/j2objc-annotations-1.3.jar
~/.m2/repository/org/opensaml/opensaml-core/4.0.1/opensaml-core-4.0.1.jar
~/.m2/repository/io/dropwizard/metrics/metrics-core/4.1.4/metrics-core-4.1.4.jar
~/.m2/repository/org/opensaml/opensaml-security-api/4.0.1/opensaml-security-api-4.0.1.jar
~/.m2/repository/org/opensaml/opensaml-messaging-api/4.0.1/opensaml-messaging-api-4.0.1.jar
~/.m2/repository/org/cryptacular/cryptacular/1.2.4/cryptacular-1.2.4.jar
~/.m2/repository/org/bouncycastle/bcpkix-jdk15on/1.64/bcpkix-jdk15on-1.64.jar
~/.m2/repository/org/springframework/spring-core/5.2.9.RELEASE/spring-core-5.2.9.RELEASE.jar
~/.m2/repository/org/springframework/spring-jcl/5.2.9.RELEASE/spring-jcl-5.2.9.RELEASE.jar
~/.m2/repository/org/opensaml/opensaml-xmlsec-api/4.0.1/opensaml-xmlsec-api-4.0.1.jar
~/.m2/repository/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar
~/.m2/repository/org/apache/santuario/xmlsec/2.0.6/xmlsec-2.0.6.jar
~/.m2/repository/org/codehaus/woodstox/woodstox-core-asl/4.4.1/woodstox-core-asl-4.4.1.jar
~/.m2/repository/javax/xml/stream/stax-api/1.0-2/stax-api-1.0-2.jar
~/.m2/repository/org/codehaus/woodstox/stax2-api/3.1.4/stax2-api-3.1.4.jar
~/.m2/repository/org/bouncycastle/bcprov-jdk15on/1.64/bcprov-jdk15on-1.64.jar
~/.m2/repository/com/beust/jcommander/1.78/jcommander-1.78.jar
~/.m2/repository/org/apache/httpcomponents/httpclient/4.5.12/httpclient-4.5.12.jar
~/.m2/repository/org/apache/httpcomponents/httpcore/4.4.13/httpcore-4.4.13.jar
~/.m2/repository/commons-codec/commons-codec/1.14/commons-codec-1.14.jar
~/.m2/repository/org/opensaml/opensaml-xmlsec-impl/4.0.1/opensaml-xmlsec-impl-4.0.1.jar
~/.m2/repository/org/opensaml/opensaml-security-impl/4.0.1/opensaml-security-impl-4.0.1.jar
~/.m2/repository/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3.jar
~/.m2/repository/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar
~/.m2/repository/org/slf4j/jcl-over-slf4j/1.7.30/jcl-over-slf4j-1.7.30.jar