You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ws.apache.org by "gregjotau (via GitHub)" <gi...@apache.org> on 2026/08/25 07:29:30 UTC
[PR] Use provider-neutral X.509 key identifier parsing [ws-wss4j]
gregjotau opened a new pull request, #653:
URL: https://github.com/apache/ws-wss4j/pull/653
## What this changes
- Replaces the direct Bouncy Castle ASN.1 use for X.509 AuthorityKeyIdentifier and SubjectKeyIdentifier extraction with WSS4J's existing `DERDecoder`.
- Retains the historical `BouncyCastleUtils` class name and all public method signatures for binary/source compatibility.
- Hardens `DERDecoder` against out-of-bounds skips/reads and overflowing or unsupported length fields while making its documented indefinite-length result explicit.
## Compatibility
The existing return behavior is preserved:
- a missing extension returns an empty byte array;
- an AuthorityKeyIdentifier extension without a key identifier returns `null`;
- malformed extension data still surfaces as `IllegalArgumentException` from `BouncyCastleUtils`.
This does not remove WSS4J's optional BC provider support or change its SAML/OpenSAML dependencies. It removes the direct BC linkage from the standard X.509 key-identifier path, which is useful independently and is a prerequisite for downstream applications that want a provider-neutral runtime.
## Verification
- `mvn -pl ws-security-common -am verify` passed for the full three-project reactor.
- Full `ws-security-common` suite: 4,088 tests, 0 failures/errors/skips.
- Existing real-certificate AKI/SKI extraction and `MerlinAKI` trust verification remain green.
- Added focused bounds/length tests for `DERDecoder`.
- Added an isolated classloader test that loads real `wss40` and CA JKS certificates, deliberately hides `org.bouncycastle.*`, and verifies the certificate AKI equals the issuer SKI.
- PMD, Checkstyle, compiler/Error Prone, packaging, and CycloneDX steps pass.
- Production source has no direct `org.bouncycastle` imports, and compiled `ws-security-common` classes contain no `org/bouncycastle` bytecode references.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
Re: [PR] Use provider-neutral X.509 key identifier parsing [ws-wss4j]
Posted by "gregjotau (via GitHub)" <gi...@apache.org>.
gregjotau closed pull request #653: Use provider-neutral X.509 key identifier parsing
URL: https://github.com/apache/ws-wss4j/pull/653
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org
Re: [PR] Use provider-neutral X.509 key identifier parsing [ws-wss4j]
Posted by "gregjotau (via GitHub)" <gi...@apache.org>.
gregjotau commented on PR #653:
URL: https://github.com/apache/ws-wss4j/pull/653#issuecomment-5536004698
The team can take over this. I dont' need ownership, I just want stuff done and efficient ;)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@ws.apache.org
For additional commands, e-mail: dev-help@ws.apache.org