Skip to content

[deps] upgrade BC to version 1.84 #360

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kares merged 3 commits into from
Apr 20, 2026
Merged

[deps] upgrade BC to version 1.84 #360

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
08595c3
[deps] upgrade BC to version 1.84
chadlwilson Apr 20, 2026
e26646c
[test] fix compatibility with rake 13.4
chadlwilson Apr 20, 2026
24760d1
[deps] bump jruby and polyglot-ruby plugins to latest
chadlwilson Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions Mavenfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,12 +104,12 @@ plugin :deploy, '3.1.4' do
execute_goals( :deploy, :skip => false )
end

supported_bc_versions = %w{ 1.78 1.79 1.80 1.81 1.82 1.83 }
supported_bc_versions = %w{ 1.78 1.79 1.80 1.81 1.82 1.83 1.84 }

default_bc_version = File.read File.expand_path('lib/jopenssl/version.rb', File.dirname(__FILE__))
default_bc_version = default_bc_version[/BOUNCY_CASTLE_VERSION\s?=\s?'(.*?)'/, 1]

properties( 'jruby.plugins.version' => '3.0.2',
properties( 'jruby.plugins.version' => '3.0.6',
'jruby.switches' => '-W0', # https://github.com/torquebox/jruby-maven-plugins/issues/94
'bc.versions' => default_bc_version,
'invoker.test' => '${bc.versions}',
Expand All @@ -118,7 +118,7 @@ properties( 'jruby.plugins.version' => '3.0.2',
'skipRunit' => 'true',
'runit.dir' => 'src/test/ruby/**/test_*.rb',
'mavengem.wagon.version' => '2.0.2', # for jruby plugin
'mavengem-wagon.version' => '2.0.2', # for polyglot-ruby
'mavengem-wagon.version' => '3.0.0', # for polyglot-ruby
# use this version of jruby for the jruby-maven-plugins
'jruby.versions' => MVN_JRUBY_VERSION, 'jruby.version' => MVN_JRUBY_VERSION,
# dump pom.xml when running 'rmvn'
Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ the JRuby [mailing list][1] or the [bug tracker][2].
| ~>0.12.x | 9.1.x-9.3.x | Java 8-15 | 1.65-1.68 |
| ~>0.13.x | 9.1.x-9.4.x | Java 8-17 | 1.68-1.69 |
| ~>0.14.x | 9.1.x-9.4.x | Java 8-21 | 1.71-1.74 |
| ~>0.15.x | 9.2.x-10.0.x | Java 8-25 | 1.78-1.83 |
| ~>0.15.x | 9.2.x-10.0.x | Java 8-25 | 1.78-1.84 |

NOTE: backwards JRuby compatibility was not handled for versions <= **0.9.6**

Expand Down
4 changes: 2 additions & 2 deletions Rakefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ Rake::TestTask.new do |task|
test_files = FileList['src/test/ruby/**/test*.rb'].to_a
task.test_files = test_files.map { |path| path.sub('src/test/ruby/', '') }
task.verbose = true
task.loader = :direct
task.loader = "ARGV.each { |f| require f unless f.start_with?('-') }"
task.ruby_opts = [ '-C', 'src/test/ruby', '-rbundler/setup' ]
end
task :test => 'lib/jopenssl.jar'
Expand All @@ -49,7 +49,7 @@ namespace :integration do
unless File.exist?(File.join(it_path, 'Gemfile.lock'))
raise "bundle not installed, run `rake integration:install'"
end
loader = "ARGV.each { |f| require f }"
loader = "ARGV.each { |f| require f unless f.start_with?('-') }"
lib = [ File.expand_path('../lib', __FILE__), it_path ]
Comment thread
chadlwilson marked this conversation as resolved.
test_files = FileList['src/test/integration/*_test.rb'].map { |path| path.sub('src/test/integration/', '') }
ruby "-I#{lib.join(':')} -C src/test/integration -e \"#{loader}\" #{test_files.map { |f| "\"#{f}\"" }.join(' ')}"
Expand Down
4 changes: 2 additions & 2 deletions integration/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@
<build>
<plugins>
<plugin>
<groupId>de.saumya.mojo</groupId>
<groupId>org.jruby.maven</groupId>
<artifactId>gem-maven-plugin</artifactId>
<version>${jruby.plugins.version}</version>
<executions>
Expand Down Expand Up @@ -97,7 +97,7 @@
</configuration>
</plugin>
<plugin>
<groupId>de.saumya.mojo</groupId>
<groupId>org.jruby.maven</groupId>
<artifactId>runit-maven-plugin</artifactId>
<version>${jruby.plugins.version}</version>
<executions>
Expand Down
2 changes: 1 addition & 1 deletion lib/jopenssl/version.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module JOpenSSL
VERSION = '0.15.8.dev'
BOUNCY_CASTLE_VERSION = '1.83'
BOUNCY_CASTLE_VERSION = '1.84'
end

Object.class_eval do
Expand Down
30 changes: 15 additions & 15 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,15 +60,15 @@ DO NOT MODIFY - GENERATED CODE
</snapshotRepository>
</distributionManagement>
<properties>
<bc.versions>1.83</bc.versions>
<bc.versions>1.84</bc.versions>
<invoker.skip>${maven.test.skip}</invoker.skip>
<invoker.test>${bc.versions}</invoker.test>
<jruby.plugins.version>3.0.2</jruby.plugins.version>
<jruby.plugins.version>3.0.6</jruby.plugins.version>
<jruby.switches>-W0</jruby.switches>
<jruby.version>9.2.19.0</jruby.version>
<jruby.versions>9.2.19.0</jruby.versions>
<mavengem-wagon.version>2.0.2</mavengem-wagon.version>
<mavengem.wagon.version>2.0.2</mavengem.wagon.version>
<mavengem.wagon.version>2.0.2</mavengem.wagon.version> <!-- for jruby plugin -->
<mavengem-wagon.version>3.0.0</mavengem-wagon.version> <!-- for polyglot-ruby -->
<polyglot.dump.pom>pom.xml</polyglot.dump.pom>
<polyglot.dump.readonly>false</polyglot.dump.readonly>
<runit.dir>src/test/ruby/**/test_*.rb</runit.dir>
Expand All @@ -78,22 +78,22 @@ DO NOT MODIFY - GENERATED CODE
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk18on</artifactId>
<version>1.83</version>
<version>1.84</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk18on</artifactId>
<version>1.83</version>
<version>1.84</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bctls-jdk18on</artifactId>
<version>1.83</version>
<version>1.84</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcutil-jdk18on</artifactId>
<version>1.83</version>
<version>1.84</version>
</dependency>
<dependency>
<groupId>org.jruby</groupId>
Expand Down Expand Up @@ -407,7 +407,7 @@ DO NOT MODIFY - GENERATED CODE
</plugins>
</build>
<properties>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83</bc.versions>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83,1.84</bc.versions>
<jruby.version>9.2.19.0</jruby.version>
<jruby.versions>9.2.19.0</jruby.versions>
</properties>
Expand Down Expand Up @@ -445,7 +445,7 @@ DO NOT MODIFY - GENERATED CODE
</plugins>
</build>
<properties>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83</bc.versions>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83,1.84</bc.versions>
<jruby.version>9.2.20.1</jruby.version>
<jruby.versions>9.2.20.1</jruby.versions>
</properties>
Expand Down Expand Up @@ -483,7 +483,7 @@ DO NOT MODIFY - GENERATED CODE
</plugins>
</build>
<properties>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83</bc.versions>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83,1.84</bc.versions>
<jruby.version>9.3.3.0</jruby.version>
<jruby.versions>9.3.3.0</jruby.versions>
</properties>
Expand Down Expand Up @@ -521,7 +521,7 @@ DO NOT MODIFY - GENERATED CODE
</plugins>
</build>
<properties>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83</bc.versions>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83,1.84</bc.versions>
<jruby.version>9.3.13.0</jruby.version>
<jruby.versions>9.3.13.0</jruby.versions>
</properties>
Expand Down Expand Up @@ -559,7 +559,7 @@ DO NOT MODIFY - GENERATED CODE
</plugins>
</build>
<properties>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83</bc.versions>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83,1.84</bc.versions>
<jruby.version>9.4.8.0</jruby.version>
<jruby.versions>9.4.8.0</jruby.versions>
</properties>
Expand Down Expand Up @@ -597,7 +597,7 @@ DO NOT MODIFY - GENERATED CODE
</plugins>
</build>
<properties>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83</bc.versions>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83,1.84</bc.versions>
<jruby.version>9.4.14.0</jruby.version>
<jruby.versions>9.4.14.0</jruby.versions>
</properties>
Expand Down Expand Up @@ -635,7 +635,7 @@ DO NOT MODIFY - GENERATED CODE
</plugins>
</build>
<properties>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83</bc.versions>
<bc.versions>1.78,1.79,1.80,1.81,1.82,1.83,1.84</bc.versions>
<jruby.version>10.0.2.0</jruby.version>
<jruby.versions>10.0.2.0</jruby.versions>
</properties>
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/org/jruby/ext/openssl/impl/PKey.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,7 +297,7 @@ public static KeyPair readECPrivateKey(final KeyFactory keyFactory, final Privat
org.bouncycastle.asn1.sec.ECPrivateKey key = org.bouncycastle.asn1.sec.ECPrivateKey.getInstance(seq);
AlgorithmIdentifier algId = keyInfo.getPrivateKeyAlgorithm();
if (algId == null) { // mockPrivateKeyInfo
algId = new AlgorithmIdentifier(X9ObjectIdentifiers.id_ecPublicKey, key.getParameters());
algId = new AlgorithmIdentifier(X9ObjectIdentifiers.id_ecPublicKey, key.getParametersObject().toASN1Primitive());
Copy link
Copy Markdown
Contributor Author

@chadlwilson chadlwilson Apr 20, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Deprecated method removed; inlined to the deprecated implementation. Replacement has been there at least since 1.78 so should be sufficiently backwards compatible.

https://github.com/bcgit/bc-java/blob/30c6cc60ef5aa9062a083a8cea3e5c4f96d91a2a/core/src/main/java/org/bouncycastle/asn1/sec/ECPrivateKey.java#L147-L154

Copy link
Copy Markdown
Member

@kares kares Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

recall there was a reason it's been kept, not sure.
think we might push master as 0.16.x anyway (due other updates).

Copy link
Copy Markdown
Contributor Author

@chadlwilson chadlwilson Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is master able to be used on 9.4 without other changes to JRuby itself? Preferably we could preserve ability to somehow release a version suitable for 9.4 due to the CVE noise even if we create a branch off a previous 0.15.x? (that seems like extra hassle though)

Copy link
Copy Markdown
Member

@kares kares Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is master able to be used on 9.4 without other changes to JRuby itself?

current compat is (still) >= 9.2 ish, although we should be dropping < 9.3 at least maybe even 9.3 soon

Copy link
Copy Markdown
Contributor Author

@chadlwilson chadlwilson Apr 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I saw that, but the test setup is rather complex so I couldn't quite figure out if the tests were in fact running against all those versions on GHA or not. Didn't spend much time though.

In any case, I guess that means we should be able to upgrade jruby 9.4's bundled version from 0.15.5 to 0.15.8|0.16.0 as well. I presume upgrading the stdlib bundled version is a bit higher risk since it's not user controlled; but this is what is required to get scanners to stop complaining - since they see the BC jars inside and 9.4 has some ancient ones even if you add/override the gem yourself from outside, e.g

One or more dependencies were identified with known vulnerabilities in gocd:

jruby-stdlib-9.4.14.0.jar: bcprov-jdk18on-1.79.jar (pkg:maven/org.bouncycastle/bcprov-jdk18on@1.79, cpe:2.3:a:bouncycastle:bouncy_castle_for_java:1.79:*:*:*:*:*:*:*) : CVE-2026-5588

}
final PrivateKeyInfo privInfo = new PrivateKeyInfo(algId, key);
ECPrivateKey privateKey = (ECPrivateKey) keyFactory.generatePrivate(new PKCS8EncodedKeySpec(privInfo.getEncoded()));
Expand Down
2 changes: 1 addition & 1 deletion src/test/ruby/test_helper.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ def self.plugin_output_init(options)
rescue LoadError => e
warn "gem 'minitest' failed to load: #{e.inspect}"
end unless (Test::Unit::AutoRunner.respond_to?(:setup_option)) rescue true # runit rules
# @see https://github.com/torquebox/jruby-maven-plugins/blob/master/runit-maven-plugin/src/main/java/de/saumya/mojo/runit/RunitMavenTestScriptFactory.java
# @see https://github.com/jruby/jruby-maven-plugins/blob/master/runit-maven-plugin/src/main/java/de/saumya/mojo/runit/RunitMavenTestScriptFactory.java

if defined? Minitest::Test
TestCase = Minitest::Test
Expand Down
Loading