chore: migrate mobile-crypto to BouncyCastle on Android#7461
Conversation
Pin the mobile-crypto dependency to the commit that migrates the Android implementation from the unmaintained SpongyCastle fork to BouncyCastle (bcprov-jdk18on 1.84). Refreshes pnpm-lock.yaml and iOS Podfile.lock (MobileCrypto 0.3.0 -> 0.4.0).
GitHub Actions
Inactive
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (1)
✅ Files skipped from review due to trivial changes (1)
📜 Recent review details⏰ Context from checks skipped due to timeout. (4)
WalkthroughThis PR adds ChangesAndroid build configuration update
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (2)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 52: Keep the `@rocket.chat/mobile-crypto` dependency pinned to the current
RocketChat/rocket.chat-mobile-crypto#adbcf7cde4469f31efe1d4bc72a98a0ced1b80f5
reference in package.json and do not advance it until the upstream lint and test
checks are green. If this change is part of a version bump, revert only the
crypto dependency entry and preserve the existing pin so the app continues using
the known-good artifact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 444bfaee-9a97-45cb-a960-d9baa9522e01
⛔ Files ignored due to path filters (2)
ios/Podfile.lockis excluded by!**/*.lockpnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: ESLint and Test / run-eslint-and-test
- GitHub Check: format
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{js,jsx,ts,tsx,json}
📄 CodeRabbit inference engine (CLAUDE.md)
Use Prettier formatting with tabs, single quotes, 130 character line width, no trailing commas, and avoid arrow function parentheses
Files:
package.json
🧠 Learnings (2)
📚 Learning: 2026-02-05T13:55:00.974Z
Learnt from: Rohit3523
Repo: RocketChat/Rocket.Chat.ReactNative PR: 6930
File: package.json:101-101
Timestamp: 2026-02-05T13:55:00.974Z
Learning: In this repository, the dependency on react-native-image-crop-picker should reference the RocketChat fork (RocketChat/react-native-image-crop-picker) with explicit commit pins, not the upstream ivpusic/react-native-image-crop-picker. Update package.json dependencies (and any lockfile) to point to the fork URL and a specific commit, ensuring edge-to-edge Android fixes are included. This pattern should apply to all package.json files in the repo that declare this dependency.
Applied to files:
package.json
📚 Learning: 2026-05-07T17:47:14.516Z
Learnt from: diegolmello
Repo: RocketChat/Rocket.Chat.ReactNative PR: 7303
File: package.json:5-5
Timestamp: 2026-05-07T17:47:14.516Z
Learning: When reviewing pnpm `packageManager` version pins in any `package.json` (e.g., `"packageManager": "pnpm@<version>"`), don’t rely solely on web-search results to determine whether a version exists. For very recently published versions, cross-check the target version against the official pnpm release page (https://github.com/pnpm/pnpm/releases) and the npm registry page for pnpm (https://www.npmjs.com/package/pnpm) before flagging the pinned version as non-existent.
Applied to files:
package.json
| "@rocket.chat/media-signaling": "1.0.0-rc.1", | ||
| "@rocket.chat/message-parser": "0.31.31", | ||
| "@rocket.chat/mobile-crypto": "RocketChat/rocket.chat-mobile-crypto#main", | ||
| "@rocket.chat/mobile-crypto": "RocketChat/rocket.chat-mobile-crypto#adbcf7cde4469f31efe1d4bc72a98a0ced1b80f5", |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
commit='adbcf7cde4469f31efe1d4bc72a98a0ced1b80f5'
rg -n "$commit|MobileCrypto|`@rocket.chat/mobile-crypto`" package.json pnpm-lock.yaml ios/Podfile.lock
gh pr view 15 \
--repo RocketChat/rocket.chat-mobile-crypto \
--json state,mergeStateStatus,headRefOid,statusCheckRollup,urlRepository: RocketChat/Rocket.Chat.ReactNative
Length of output: 3990
Hold this crypto pin until upstream is green. RocketChat/rocket.chat-mobile-crypto#adbcf7cde4469f31efe1d4bc72a98a0ced1b80f5 still has failing lint and test checks, so this encryption dependency is not yet backed by a clean upstream artifact.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` at line 52, Keep the `@rocket.chat/mobile-crypto` dependency
pinned to the current
RocketChat/rocket.chat-mobile-crypto#adbcf7cde4469f31efe1d4bc72a98a0ced1b80f5
reference in package.json and do not advance it until the upstream lint and test
checks are green. If this change is part of a version bump, revert only the
crypto dependency entry and preserve the existing pin so the app continues using
the known-good artifact.
bcprov-jdk18on:1.84 ships Java 25 multi-release classes that Jetifier's bundled ASM cannot parse (Unsupported class file major version 69), failing the release Kotlin compile of mobile-crypto. BouncyCastle is already AndroidX-clean and needs no jetifying, so add it to the jetifier ignorelist.
|
iOS Build Available Rocket.Chat 4.75.0.109261 |
GitHub Actions
Inactive
…dle.properties CI regenerates android/gradle.properties from scratch (echo > ...), so the android.jetifier.ignorelist entry committed to the checked-in file is discarded for CI builds. Add it to both gradle.properties generators (the build-android composite action and the e2e-build-android workflow) so the release build can resolve bcprov-jdk18on:1.84 without Jetifier choking on its Java 25 multi-release classes.
|
iOS Build Available Rocket.Chat 4.75.0.109267 |
GitHub Actions
Inactive
bcprov-jdk18on:1.84 and its transitive org.jspecify both bundle META-INF/versions/9/OSGI-INF/MANIFEST.MF inside their multi-release jars, so mergeReleaseJavaResource fails with a DuplicateRelativeFileException. Exclude that OSGi bundle manifest (unused on Android) via a packaging block.
|
iOS Build Available Rocket.Chat 4.75.0.109271 |
GitHub Actions
Inactive
GitHub Actions
Error
|
Android Build Available Rocket.Chat 4.75.0.109272 Internal App Sharing: https://play.google.com/apps/test/RQQ8k09hlnQ/ahAO29uNRhnuXBeWag6M5exHKyHfHqPKu5vKZ-s8Y2muv8PNjDsxQPV27T4j9hnL5N-OgjJ5p-Rbb1SXrZGE2s5XC3 |
|
iOS Build Available Rocket.Chat 4.75.0.109273 |
The mobile-crypto SpongyCastle to BouncyCastle change is a pure package rename with no algorithm change and no JCE provider registration, so it cannot alter crypto output. Re-running the pipeline to confirm the prior E2E Run Android shard-3 (e2e-encryption) failure was environmental.
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Error
|
Android Build Available Rocket.Chat 4.75.0.109283 Internal App Sharing: https://play.google.com/apps/test/RQQ8k09hlnQ/ahAO29uNTAtH44LMF5pQsbyhAZxRyBVOUydrpHXTQ2nmSBMnmkYSs26hk2AXOa4jLr0st8v6cyQv3KhEWVEM9xdXbb |
|
iOS Build Available Rocket.Chat 4.75.0.109284 |
# Conflicts: # .github/workflows/e2e-build-android.yml
GitHub Actions
Inactive
GitHub Actions
Waiting
|
Android Build Available Rocket.Chat 4.75.0.109286 Internal App Sharing: https://play.google.com/apps/test/RQQ8k09hlnQ/ahAO29uNQKvbO3Y6S8KRRkY00RD-pteUd1X-sl9oUrFLMZt_sWjvr-98GeyrZar6TvSd6jvgrndrhtpRNcZCHtP7Dh |
|
iOS Build Available Rocket.Chat 4.75.0.109288 |
2 participants
Proposed changes
Bumps the
@rocket.chat/mobile-cryptodependency to the build that migrates the Android crypto implementation off the unmaintained SpongyCastle fork (com.madgag.spongycastle) onto BouncyCastle (org.bouncycastle:bcprov-jdk18on:1.84). The swap is mechanical — identical class names, no logic changes — and the library is only ever used as plain classes (never registered as a JCE provider), so there is no collision with Android's platform BouncyCastle namespace.This PR is the consumer-side change only. It pins the dependency to the crypto commit
adbcf7cde4469f31efe1d4bc72a98a0ced1b80f5and refreshes the lockfiles:package.json/pnpm-lock.yaml— repin@rocket.chat/mobile-cryptoios/Podfile.lock— MobileCrypto0.3.0→0.4.0The upstream library change lives in RocketChat/rocket.chat-mobile-crypto#15.
Issue(s)
How to test or reproduce
E2E encryption exercises the migrated code paths (RSA OAEP/PKCS#1, PBKDF2). On both platforms:
The upstream PR verified byte-compatibility with a known-answer harness (31/31 fixed-vector KATs pass on Android API 36, expected values shared with iOS).
Screenshots
Types of changes
Checklist
Further comments
The dependency is pinned to a commit on the upstream feature branch rather than
#main, because RocketChat/rocket.chat-mobile-crypto#15 is not yet merged. Before this can ship todevelop, that PR should be merged and the pin moved back to the resulting#maincommit. Note the upstream PR currently has redlintandtestchecks (unit tests are tracked separately in NATIVE-1378).Summary by CodeRabbit