<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 2020-09-27, at 08:42, Weiwu Zhang via dev <<a href="mailto:dev@shibboleth.net" class="">dev@shibboleth.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><br class="">I have a case that caused the binary distribution† of 27-April-2020 to throw an exception<br class=""><br class="">† xmlsectool-2.0.0-bin.zip downloaded from <a href="http://shibboleth.net/downloads/tools/xmlsectool/2.0.0/" class="">http://shibboleth.net/downloads/tools/xmlsectool/2.0.0/</a><br class=""></div></div></blockquote><div><br class=""></div><div>I think you have been misled by the file dates, which were updated when we moved to a new server. In fact, that distribution dates to 2016-06-27. It is still the current stable release, however.</div><div><br class=""></div><div>This release is supported under Java 7 (although these days I would recommend against it), Java 8 and Java 11. We neither test nor support XMLSecTool V2 against Java 14. I'm still interested -- in principle -- in getting to the bottom of your issue, so please open a JIRA case. I'd also appreciate it if you can try to reproduce the issue under a supported version of Java, for example Java 11.</div><div><br class=""></div><div>It would also help if you could provide steps to generate a similar key (obviously not the one you're using).</div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class="">while the source code cloned‡ works.</div></div></blockquote><blockquote type="cite" class=""><div class=""><div class="">‡ git clone <a href="https://git.shibboleth.net/git/xmlsectool" class="">https://git.shibboleth.net/git/xmlsectool</a><br class=""></div></div></blockquote><div><br class=""></div><div>This will build a snapshot of the forthcoming 3.0.0 release. That's obviously very different in some ways, and in particular it is based on Java 11 rather than Java 7. It will support Java 11 and, I expect, Java 17 when it comes along. It will not directly support Java 14, but we do test the snapshots against Java 14 today to make sure that we get everything right for Java 17 (the next LTS release).</div><div><br class=""></div><div>If that's working for you, it looks like we have already fixed the problem, possibly just by using more modern dependencies. I'd still like to add a test for this if possible, though, which is why I will be interested to see more details in a JIRA case.</div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class="">I am not sure what's the trigger, but my guess is that BouncyCastle<br class="">didn't recognise the secp256r1 EC key used here.<br class=""></div></div></blockquote><div><br class=""></div><div>That's entirely possible.</div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div class="">In the commandline "…" represent the bunch of dependency jar files on<br class="">my system†. Most noticablly, the version of BouncyCastle used is 1.64<br class="">(compared to the embeded 1.53 brprov which threw up). Could it be the<br class="">cause that the binary distribution failed?<br class=""></div></div></blockquote><div><br class=""></div><div>No, the binary distribution is correct, but it's from 2016 and it has a lot of 2016-era dependencies included, which may well be the reason it doesn't handle your use case.</div><div><br class=""></div><div>However, one thing you really can't do is just substitute a lot of uncontrolled dependencies from your local machine. Or at least, we can't support you if you take that route. What you need to do is instead use Maven to build the project you cloned (mvn -Prelease clean package). This will give you (in target/xmlsectool-3.0.0-SNAPSHOT-bin.zip) something that is directly comparable with the previous release in that it includes all of the dependencies we will ship V3 with (including, of course, BouncyCastle 1.64). If there's a problem with that combination, of course we'll try to address that. </div><div><br class=""></div></div><div class=""><span class="Apple-style-span" style="border-collapse: separate; font-variant-ligatures: normal; font-variant-east-asian: normal; font-variant-position: normal; line-height: normal; border-spacing: 0px; -webkit-text-decorations-in-effect: none;"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; border-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-stroke-width: 0px;"><div class=""> -- Ian<br class=""></div><div class=""><span class="Apple-style-span" style="font-size: medium;"><br class=""></span></div></span></div></span><br class="Apple-interchange-newline"><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>