Merge pull request #1489 from google/sbgoog-patch-1

Evolving Conscrypt's Open Source Approach

Author: sbgoog

README.md

@@ -1,3 +1,83 @@
+# Evolving Conscrypt's Open Source Approach
+
+Hello Conscrypt Developers,
+
+We're refining our **open source strategy for Conscrypt** to ensure its long-term health and sustainability. To optimize our development efforts and focus resources, we are making some changes to how Conscrypt is developed and how we handle contributions. The primary development of Conscrypt will now be done internally at Google. While we value community input, we will no longer be able to accept external contributions in the form of pull requests on the GitHub repository. This change allows us to better allocate resources to core development and ensure the project's long-term sustainability. To ensure transparency and continued access for the community, we will:
+
+*   **Continue Mirroring to GitHub:** All internal changes will be regularly mirrored to the public GitHub repository. Note that mirroring to GitHub might be paused for a short period of time during the transition to internal development.
+*   **Maintain Bug Reporting Channels:** Please keep reporting bugs through GitHub Issues. For Android-specific bugs, the Android Issue Tracker is the place to go: [Report Bugs](https://source.android.com/docs/setup/contribute/report-bugs).
+
+### What’s staying the same
+
+The platform version of Conscrypt receives regular updates, including the latest features and security patches, through the Google Play system updates program (Project Mainline). This means that even devices running older Android versions can benefit from the most recent Conscrypt improvements without requiring a full OS update.
+
+### What’s changing
+
+As part of this shift, we will no longer be able to accept external pull requests on GitHub.
+
+### What do you need to do
+
+*   Immediately, nothing.
+*   For Android developers, we recommend leveraging the Conscrypt version built into the Android platform, which is also the default provider.
+
+We appreciate the Conscrypt community and look forward to continuing to offer a secure and efficient security provider.
+
+## Guidance for Android App Developers:
+
+Most Android devices include Conscrypt as a core part of the platform's security providers. The Java Cryptography Architecture (JCA) framework allows for multiple security providers, and the system selects one when you request a cryptographic algorithm implementation (like Cipher, SSLContext, MessageDigest, etc.).
+
+### Using the Platform Version (Recommended):
+
+To use the platform-provided Conscrypt, you generally don't need to do anything specific. When requesting an algorithm, omit the provider name. The Android system will automatically select the highest-priority provider that offers the requested algorithm, which is typically the built-in Conscrypt.
+
+*Example (Java):*
+
+```java
+import javax.net.ssl.SSLContext;
+import java.security.Security;
+import java.security.Provider;
+
+try {
+    // Get an SSLContext instance using the default highest-priority provider
+    SSLContext sslContext = SSLContext.getInstance("TLS");
+    // Initialize and use sslContext
+
+    // Example: Listing providers to see what's available
+    // Provider[] providers = Security.getProviders();
+    // for (Provider provider : providers) {
+    //     System.out.println("Provider: " + provider.getName());
+    // }
+} catch (NoSuchAlgorithmException e) {
+    // Handle exception
+    e.printStackTrace();
+}
+```
+
+*Example (Kotlin):*
+
+```kotlin
+import javax.net.ssl.SSLContext
+import java.security.Security
+import java.security.Provider
+
+try {
+    // Get an SSLContext instance using the default highest-priority provider
+    val sslContext = SSLContext.getInstance("TLS")
+    // Initialize and use sslContext
+
+    // Example: Listing providers to see what's available
+    // val providers = Security.getProviders()
+    // providers.forEach { provider ->
+    //     println("Provider: ${provider.name}")
+    // }
+} catch (e: NoSuchAlgorithmException) {
+    // Handle exception
+    e.printStackTrace()
+}
+```
+
+By *not* specifying a provider name in getInstance() calls, you rely on the Android system's default provider order, ensuring you use the up-to-date and maintained version of Conscrypt that is part of the Android platform.
+
 Conscrypt - A Java Security Provider
 ========================================