You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nifi.apache.org by "Andy LoPresto (JIRA)" <ji...@apache.org> on 2015/12/22 22:58:46 UTC
[jira] [Updated] (NIFI-1324) Upgrade to correct version of
BouncyCastle
[ https://issues.apache.org/jira/browse/NIFI-1324?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Andy LoPresto updated NIFI-1324:
--------------------------------
Description:
The existing Maven dependencies are for {{org.bouncycastle:bcprov-jdk16:1.43}} and {{org.bouncycastle:bcpg-jdk16:1.43}}. While {{jdk16}} looks "newer" than {{jdk15on}}, this was actually a legacy mistake on the part of BouncyCastle versioning. The correct and current version of BouncyCastle is {{jdk15on}}, as evidenced by the age of the releases:
* jdk15on: 03/2012 - 10/2015 "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8." (http://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk15on)
* jdk16: 11/2007 - 02/2011 "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.6." (http://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk16)
was:
The existing Maven dependencies are for org.bouncycastle:bcprov-jdk16:1.43 and org.bouncycastle:bcpg-jdk16:1.43. While <code>jdk16</code> looks "newer" than <code>jdk15on</code>, this was actually a legacy mistake on the part of BouncyCastle versioning. The correct and current version of BouncyCastle is <code>jdk15on</code>, as evidenced by the age of the releases:
* jdk15on: 03/2012 - 10/2015 "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8." (http://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk15on)
* jdk16: 11/2007 - 02/2011 "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.6." (http://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk16)
> Upgrade to correct version of BouncyCastle
> ------------------------------------------
>
> Key: NIFI-1324
> URL: https://issues.apache.org/jira/browse/NIFI-1324
> Project: Apache NiFi
> Issue Type: Task
> Components: Core Framework
> Affects Versions: 0.4.1
> Reporter: Andy LoPresto
> Assignee: Andy LoPresto
> Labels: dependencies, security
> Fix For: 0.5.0
>
>
> The existing Maven dependencies are for {{org.bouncycastle:bcprov-jdk16:1.43}} and {{org.bouncycastle:bcpg-jdk16:1.43}}. While {{jdk16}} looks "newer" than {{jdk15on}}, this was actually a legacy mistake on the part of BouncyCastle versioning. The correct and current version of BouncyCastle is {{jdk15on}}, as evidenced by the age of the releases:
> * jdk15on: 03/2012 - 10/2015 "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5 to JDK 1.8." (http://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk15on)
> * jdk16: 11/2007 - 02/2011 "The Bouncy Castle Crypto package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.6." (http://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk16)
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)