Skip to content

Commit 9a93140

Browse files
mkleenesujankota
mkleene
and
sujankota
authored
fix: we need to publish all three modules (#382)
* add artifacts necessary for publishing to `sdk-fips-bc` and `sdk-pqc-bc` * also clean up boilerplate * two consistency changes * rename `sdk-fips-bouncycastle` to `sdk-fips-bc` (this should be ok since we haven't succeeded in publishing since this module was created) * don't exclude the `sdk-pqc-bc` jar when using the FIPS profile. the provider modules need only be included/excluded by their consumers <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary * **Build & Release** * Release artifacts now include sources archives, Javadoc documentation, and checksum files (MD5/SHA-1/SHA-256/SHA-512) for generated JARs. * **Compatibility / Modules** * Updated FIPS-related module/artifact naming to use `sdk-fips-bc` (replacing `sdk-fips-bouncycastle`) across the development and release build profiles, including the cmdline runtime and reactor. * **Documentation** * Refreshed FIPS-related Javadoc text and related user-facing error messages to match the new artifact name. * **CI** * Adjusted FIPS-mode test setup to install the updated FIPS artifact. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: sujankota <sujankota@gmail.com>
1 parent 068caa7 commit 9a93140

13 files changed

Lines changed: 115 additions & 73 deletions

File tree

‎.github/workflows/checks.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -93,8 +93,8 @@ jobs:
9393
run: mvn clean --batch-mode clean generate-sources
9494
- name: Tests and enforcer (fips)
9595
run: |
96-
# install the sdk-fips-bouncycastle jar so that FIPS mode tests work
97-
mvn --batch-mode install -pl sdk-fips-bouncycastle -am \
96+
# install the sdk-fips-bc jar so that FIPS mode tests work
97+
mvn --batch-mode install -pl sdk-fips-bc -am \
9898
-Dmaven.antrun.skip \
9999
-Dmaven.test.skip
100100
mvn --batch-mode test enforcer:enforce -P 'fips,!non-fips' \

‎cmdline/pom.xml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,9 @@
8888
<dependencies>
8989
<dependency>
9090
<groupId>io.opentdf.platform</groupId>
91-
<artifactId>sdk-fips-bouncycastle</artifactId>
91+
<artifactId>sdk-fips-bc</artifactId>
9292
<version>${project.version}</version>
93+
<scope>runtime</scope>
9394
</dependency>
9495
</dependencies>
9596
</profile>

‎pom.xml‎

Lines changed: 65 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,67 @@
218218
<artifactId>maven-deploy-plugin</artifactId>
219219
<version>3.1.2</version>
220220
</plugin>
221+
<!-- Plugin to create source JAR -->
222+
<plugin>
223+
<groupId>org.apache.maven.plugins</groupId>
224+
<artifactId>maven-source-plugin</artifactId>
225+
<version>3.3.1</version>
226+
<executions>
227+
<execution>
228+
<id>attach-sources</id>
229+
<goals>
230+
<goal>jar</goal>
231+
</goals>
232+
</execution>
233+
</executions>
234+
</plugin>
235+
<!-- Plugin to create Javadoc JAR -->
236+
<plugin>
237+
<groupId>org.jetbrains.dokka</groupId>
238+
<artifactId>dokka-maven-plugin</artifactId>
239+
<version>2.0.0</version>
240+
<executions>
241+
<execution>
242+
<id>javadoc</id>
243+
<phase>package</phase>
244+
<goals>
245+
<goal>javadocJar</goal>
246+
</goals>
247+
</execution>
248+
</executions>
249+
</plugin>
250+
<!-- Plugin to generate checksum files -->
251+
<plugin>
252+
<groupId>net.nicoulaj.maven.plugins</groupId>
253+
<artifactId>checksum-maven-plugin</artifactId>
254+
<version>1.11</version>
255+
<executions>
256+
<execution>
257+
<id>create-checksums</id>
258+
<phase>package</phase>
259+
<goals>
260+
<goal>files</goal>
261+
</goals>
262+
<configuration>
263+
<algorithms>
264+
<algorithm>MD5</algorithm>
265+
<algorithm>SHA-1</algorithm>
266+
<algorithm>SHA-256</algorithm>
267+
<algorithm>SHA-512</algorithm>
268+
</algorithms>
269+
<failOnError>true</failOnError>
270+
<fileSets>
271+
<fileSet>
272+
<directory>${project.build.directory}</directory>
273+
<includes>
274+
<include>*.jar</include>
275+
</includes>
276+
</fileSet>
277+
</fileSets>
278+
</configuration>
279+
</execution>
280+
</executions>
281+
</plugin>
221282
</plugins>
222283
</pluginManagement>
223284
<plugins>
@@ -287,28 +348,15 @@
287348
<id>develop</id>
288349
<modules>
289350
<module>sdk</module>
290-
<module>sdk-fips-bouncycastle</module>
291351
<module>cmdline</module>
352+
<module>sdk-pqc-bc</module>
353+
<module>sdk-fips-bc</module>
292354
<module>examples</module>
293355
</modules>
294356
<activation>
295357
<activeByDefault>true</activeByDefault>
296358
</activation>
297359
</profile>
298-
<profile>
299-
<!-- sdk-pqc-bc is gated behind the non-fips profile because its
300-
BC compile dependency (bcprov-jdk18on) collides with bc-fips
301-
on the same package namespace. A FIPS build (mvn -P fips,!non-fips)
302-
must omit sdk-pqc-bc from the reactor entirely; consumers who
303-
want hybrid PQC opt in via the non-fips profile. -->
304-
<id>non-fips</id>
305-
<activation>
306-
<activeByDefault>true</activeByDefault>
307-
</activation>
308-
<modules>
309-
<module>sdk-pqc-bc</module>
310-
</modules>
311-
</profile>
312360
<profile>
313361
<id>stage</id>
314362
<modules>
@@ -345,7 +393,8 @@
345393
<id>release</id>
346394
<modules>
347395
<module>sdk</module>
348-
<module>sdk-fips-bouncycastle</module>
396+
<module>sdk-pqc-bc</module>
397+
<module>sdk-fips-bc</module>
349398
</modules>
350399
<activation>
351400
<activeByDefault>false</activeByDefault>

sdk-fips-bouncycastle/pom.xml renamed to sdk-fips-bc/pom.xml

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@
66
<artifactId>sdk-pom</artifactId>
77
<version>0.17.0</version>
88
</parent>
9-
<artifactId>sdk-fips-bouncycastle</artifactId>
10-
<name>io.opentdf.platform:sdk-fips-bouncycastle</name>
9+
<artifactId>sdk-fips-bc</artifactId>
10+
<name>io.opentdf.platform:sdk-fips-bc</name>
1111
<description>BouncyCastle FIPS-backed HkdfProvider SPI implementation (FIPS 140-approved HKDF via bc-fips).</description>
1212
<packaging>jar</packaging>
1313
<properties>
@@ -38,4 +38,23 @@
3838
<scope>test</scope>
3939
</dependency>
4040
</dependencies>
41+
<build>
42+
<plugins>
43+
<!-- Plugin to create source JAR -->
44+
<plugin>
45+
<groupId>org.apache.maven.plugins</groupId>
46+
<artifactId>maven-source-plugin</artifactId>
47+
</plugin>
48+
<!-- Plugin to create Javadoc JAR -->
49+
<plugin>
50+
<groupId>org.jetbrains.dokka</groupId>
51+
<artifactId>dokka-maven-plugin</artifactId>
52+
</plugin>
53+
<!-- Plugin to generate checksum files -->
54+
<plugin>
55+
<groupId>net.nicoulaj.maven.plugins</groupId>
56+
<artifactId>checksum-maven-plugin</artifactId>
57+
</plugin>
58+
</plugins>
59+
</build>
4160
</project>

sdk-fips-bouncycastle/src/main/java/io/opentdf/platform/sdk/fips/bouncycastle/BouncyCastleFipsHkdfProvider.java renamed to sdk-fips-bc/src/main/java/io/opentdf/platform/sdk/fips/bouncycastle/BouncyCastleFipsHkdfProvider.java

File renamed without changes.

sdk-fips-bouncycastle/src/main/resources/META-INF/services/io.opentdf.platform.sdk.HkdfProvider renamed to sdk-fips-bc/src/main/resources/META-INF/services/io.opentdf.platform.sdk.HkdfProvider

File renamed without changes.

sdk-fips-bouncycastle/src/test/java/io/opentdf/platform/sdk/fips/bouncycastle/BouncyCastleFipsHkdfProviderTest.java renamed to sdk-fips-bc/src/test/java/io/opentdf/platform/sdk/fips/bouncycastle/BouncyCastleFipsHkdfProviderTest.java

File renamed without changes.

‎sdk-pqc-bc/pom.xml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,4 +79,23 @@
7979
<scope>test</scope>
8080
</dependency>
8181
</dependencies>
82+
<build>
83+
<plugins>
84+
<!-- Plugin to create source JAR -->
85+
<plugin>
86+
<groupId>org.apache.maven.plugins</groupId>
87+
<artifactId>maven-source-plugin</artifactId>
88+
</plugin>
89+
<!-- Plugin to create Javadoc JAR -->
90+
<plugin>
91+
<groupId>org.jetbrains.dokka</groupId>
92+
<artifactId>dokka-maven-plugin</artifactId>
93+
</plugin>
94+
<!-- Plugin to generate checksum files -->
95+
<plugin>
96+
<groupId>net.nicoulaj.maven.plugins</groupId>
97+
<artifactId>checksum-maven-plugin</artifactId>
98+
</plugin>
99+
</plugins>
100+
</build>
82101
</project>

‎sdk/pom.xml‎

Lines changed: 1 addition & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -286,15 +286,6 @@
286286
<plugin>
287287
<groupId>org.apache.maven.plugins</groupId>
288288
<artifactId>maven-source-plugin</artifactId>
289-
<version>3.3.1</version>
290-
<executions>
291-
<execution>
292-
<id>attach-sources</id>
293-
<goals>
294-
<goal>jar</goal>
295-
</goals>
296-
</execution>
297-
</executions>
298289
</plugin>
299290
<!-- Test-jar for shared test fixtures (FakeServicesBuilder, etc.)
300291
consumed by sibling modules like sdk-pqc-bc. -->
@@ -314,48 +305,11 @@
314305
<plugin>
315306
<groupId>org.jetbrains.dokka</groupId>
316307
<artifactId>dokka-maven-plugin</artifactId>
317-
<version>2.0.0</version>
318-
<executions>
319-
<execution>
320-
<id>javadoc</id>
321-
<phase>package</phase>
322-
<goals>
323-
<goal>javadocJar</goal>
324-
</goals>
325-
</execution>
326-
</executions>
327308
</plugin>
328309
<!-- Plugin to generate checksum files -->
329310
<plugin>
330311
<groupId>net.nicoulaj.maven.plugins</groupId>
331312
<artifactId>checksum-maven-plugin</artifactId>
332-
<version>1.11</version>
333-
<executions>
334-
<execution>
335-
<id>create-checksums</id>
336-
<phase>package</phase>
337-
<goals>
338-
<goal>files</goal>
339-
</goals>
340-
<configuration>
341-
<algorithms>
342-
<algorithm>MD5</algorithm>
343-
<algorithm>SHA-1</algorithm>
344-
<algorithm>SHA-256</algorithm>
345-
<algorithm>SHA-512</algorithm>
346-
</algorithms>
347-
<failOnError>true</failOnError>
348-
<fileSets>
349-
<fileSet>
350-
<directory>${project.build.directory}</directory>
351-
<includes>
352-
<include>*.jar</include>
353-
</includes>
354-
</fileSet>
355-
</fileSets>
356-
</configuration>
357-
</execution>
358-
</executions>
359313
</plugin>
360314
<plugin>
361315
<groupId>org.apache.maven.plugins</groupId>
@@ -525,7 +479,7 @@
525479
<additionalClasspathDependencies>
526480
<dependency>
527481
<groupId>io.opentdf.platform</groupId>
528-
<artifactId>sdk-fips-bouncycastle</artifactId>
482+
<artifactId>sdk-fips-bc</artifactId>
529483
<version>${project.version}</version>
530484
</dependency>
531485
</additionalClasspathDependencies>

‎sdk/src/main/java/io/opentdf/platform/sdk/ECKeyPair.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ public static byte[] computeECDHKey(ECPublicKey publicKey, ECPrivateKey privateK
112112
* that is 32 bytes (256 bits) long.
113113
*
114114
* Delegates to a registered {@link HkdfProvider} when one is available on the
115-
* classpath (e.g. {@code sdk-fips-bouncycastle}); otherwise falls back to the
115+
* classpath (e.g. {@code sdk-fips-bc}); otherwise falls back to the
116116
* JDK-native HmacSHA256 implementation.
117117
*/
118118
public static byte[] calculateHKDF(byte[] salt, byte[] secret) {
@@ -141,7 +141,7 @@ public static byte[] calculateHKDF(byte[] salt, byte[] secret) {
141141
} catch (Exception e) {
142142
String className = e.getClass().getName();
143143
if (className.contains("bouncycastle") && className.endsWith("IllegalKeyException")) {
144-
throw new SDKException("if running bouncycastle FIPS in approved_only mode include the sdk-fips-bouncycastle jar to use HKDF", e);
144+
throw new SDKException("if running bouncycastle FIPS in approved_only mode include the sdk-fips-bc jar to use HKDF", e);
145145
}
146146
throw new SDKException("error computing HKDF", e);
147147
}

0 commit comments

Comments
 (0)