You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@beam.apache.org by Manuel Yepez <ma...@equifax.com> on 2022/06/02 15:02:13 UTC
[Bug] Upgrading from Beam 2.34.0 to 2.39.0 breaks an application using bc-fips jar libraries
Hello,
We have an application that needs to remain FIPS compliant and so we have
bc-fips-1.0.2.1.jar in our classpath. Up until now we used Beam 2.34.0
without any issue, but we are doing some upgrades to comply with security
issues. However we detected that Beam 2.39.0 added other BC jars which
conflict with bc-fips.
[image: image.png]
Running the application at this point will give the following stack trace
when registering any BC providers:
org.apache.beam.sdk.util.UserCodeException: java.lang.NoSuchMethodError:
'boolean
org.bouncycastle.crypto.CryptoServicesRegistrar.isInApprovedOnlyMode()' at
org.apache.beam.sdk.util.UserCodeException.wrap(UserCodeException.java:39)
Version 2.34.0 had no BC jars at all. Is there a way we could upgrade
safely?
--
Este mensaje contiene información de Equifax que puede ser confidencial y
reservada. Si Usted no es el destinatario final por favor evite la
difusión, copia o uso de esta información, ya que estas acciones están
prohibidas. Si Usted recibe esta comunicación por error por favor
notifíquelo vía e-mail a postmaster@equifax.com
<ma...@equifax.com>.
This message contains proprietary
information from Equifax which may be confidential. If you are not an
intended recipient, please refrain from any disclosure, copying,
distribution or use of this information and note that such actions are
prohibited. If you have received this transmission in error, please notify
by e-mail postmaster@equifax.com <ma...@equifax.com>.
Equifax® is a registered trademark of Equifax Inc. All rights reserved.
Re: [Bug] Upgrading from Beam 2.34.0 to 2.39.0 breaks an application using bc-fips jar libraries
Posted by Luke Cwik <lc...@google.com>.
Please resolve the dependency conflict by excluding bcpkix-jdk15on in your
build configuration. For example for maven:
<dependency>
<groupId>org.apache.beam</groupId>
<artifactId>beam-sdks-java-io-google-cloud-platform</artifactId>
<version>2.39.0</version>
<exclusions>
<!-- Exclude the non fips version -->
<exclusion>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
</exclusion>
<exclusion>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk15on</artifactId>
</exclusion>
</exclusions>
</dependency>
and include bcpkix-fips and bc-fips dependencies:
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-fips</artifactId>
<version>1.67.0</version>
<scope>runtime</scope>
</dependency>
On Thu, Jun 2, 2022 at 8:49 AM Ahmet Altay <al...@google.com> wrote:
> Adding folks who might have some idea: @Tomo Suzuki <su...@google.com> @Kiley
> Sok <ki...@google.com> @Lukasz Cwik <lc...@google.com>
>
> On Thu, Jun 2, 2022 at 8:35 AM Manuel Yepez <ma...@equifax.com>
> wrote:
>
>> Hello,
>>
>> We have an application that needs to remain FIPS compliant and so we have
>> bc-fips-1.0.2.1.jar in our classpath. Up until now we used Beam 2.34.0
>> without any issue, but we are doing some upgrades to comply with security
>> issues. However we detected that Beam 2.39.0 added other BC jars which
>> conflict with bc-fips.
>>
>> [image: image.png]
>>
>> Running the application at this point will give the following stack trace
>> when registering any BC providers:
>>
>> org.apache.beam.sdk.util.UserCodeException: java.lang.NoSuchMethodError:
>> 'boolean
>> org.bouncycastle.crypto.CryptoServicesRegistrar.isInApprovedOnlyMode()' at
>> org.apache.beam.sdk.util.UserCodeException.wrap(UserCodeException.java:39)
>>
>> Version 2.34.0 had no BC jars at all. Is there a way we could upgrade
>> safely?
>>
>> Este mensaje contiene información de Equifax que puede ser confidencial y
>> reservada. Si Usted no es el destinatario final por favor evite la
>> difusión, copia o uso de esta información, ya que estas acciones están
>> prohibidas. Si Usted recibe esta comunicación por error por favor
>> notifíquelo vía e-mail a postmaster@equifax.com.
>>
>> This message contains proprietary information from Equifax which may be
>> confidential. If you are not an intended recipient, please refrain from any
>> disclosure, copying, distribution or use of this information and note that
>> such actions are prohibited. If you have received this transmission in
>> error, please notify by e-mail postmaster@equifax.com.
>>
>> Equifax® is a registered trademark of Equifax Inc. All rights reserved.
>>
>
Re: [Bug] Upgrading from Beam 2.34.0 to 2.39.0 breaks an application using bc-fips jar libraries
Posted by Ahmet Altay <al...@google.com>.
Adding folks who might have some idea: @Tomo Suzuki <su...@google.com> @Kiley
Sok <ki...@google.com> @Lukasz Cwik <lc...@google.com>
On Thu, Jun 2, 2022 at 8:35 AM Manuel Yepez <ma...@equifax.com>
wrote:
> Hello,
>
> We have an application that needs to remain FIPS compliant and so we have
> bc-fips-1.0.2.1.jar in our classpath. Up until now we used Beam 2.34.0
> without any issue, but we are doing some upgrades to comply with security
> issues. However we detected that Beam 2.39.0 added other BC jars which
> conflict with bc-fips.
>
> [image: image.png]
>
> Running the application at this point will give the following stack trace
> when registering any BC providers:
>
> org.apache.beam.sdk.util.UserCodeException: java.lang.NoSuchMethodError:
> 'boolean
> org.bouncycastle.crypto.CryptoServicesRegistrar.isInApprovedOnlyMode()' at
> org.apache.beam.sdk.util.UserCodeException.wrap(UserCodeException.java:39)
>
> Version 2.34.0 had no BC jars at all. Is there a way we could upgrade
> safely?
>
> Este mensaje contiene información de Equifax que puede ser confidencial y
> reservada. Si Usted no es el destinatario final por favor evite la
> difusión, copia o uso de esta información, ya que estas acciones están
> prohibidas. Si Usted recibe esta comunicación por error por favor
> notifíquelo vía e-mail a postmaster@equifax.com.
>
> This message contains proprietary information from Equifax which may be
> confidential. If you are not an intended recipient, please refrain from any
> disclosure, copying, distribution or use of this information and note that
> such actions are prohibited. If you have received this transmission in
> error, please notify by e-mail postmaster@equifax.com.
>
> Equifax® is a registered trademark of Equifax Inc. All rights reserved.
>