Skip to content

Support BouncyCastle FIPS provider - #6588

Merged
sijie merged 13 commits into
apache:masterfrom
jiazhai:bc_fips
Mar 28, 2020
Merged

Support BouncyCastle FIPS provider #6588
sijie merged 13 commits into
apache:masterfrom
jiazhai:bc_fips

Conversation

@jiazhai

@jiazhai jiazhai commented Mar 22, 2020

Copy link
Copy Markdown
Member

Motivation

Try to make user able to use both "org.bouncycastle.jce.provider.BouncyCastleProvider" and "org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider".

Current code, bouncycastle (bc) jars are used in both broker and client, and are tied strongly in both broker and client. We need to make it easy config. This change try to split bc and module that depends on it. Then user could freely include/exclude it.

Changes

  • build a shaded jar for bouncycastle non-fips version. other module depends on this module.
  • build nar for both fips and non-fips version of bouncycastle, user could able to load bouncycastle by these 2 nar.
  • split MessageCrypto out from client and made it an individual module. so client is able to exclude bouncycastle.
  • Add 2 test examples: 1, exclude bc-non-fips version, and include bc-fips version; 2, exclude bc-non-fips version and load bc-fips version by nar.

@jiazhai jiazhai changed the title [WIP]: Support BouncyCastle FIPS provider Support BouncyCastle FIPS provider Mar 27, 2020
@tuteng

tuteng commented Mar 27, 2020

Copy link
Copy Markdown
Member

/pulsarbot run-failure-checks

1 similar comment
@jiazhai

jiazhai commented Mar 27, 2020

Copy link
Copy Markdown
Member Author

/pulsarbot run-failure-checks

@sijie sijie added this to the 2.6.0 milestone Mar 27, 2020
@tuteng

tuteng commented Mar 28, 2020

Copy link
Copy Markdown
Member

@sijie @codelipenghui PTAL

@sijie sijie left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jiazhai good job!

@sijie
sijie merged commit 181e5e7 into apache:master Mar 28, 2020
@kemburi

kemburi commented Mar 31, 2020

Copy link
Copy Markdown

can we get maven relase of the same @jiazhai, so that we can consume into our projects?

@sijie

sijie commented Mar 31, 2020

Copy link
Copy Markdown
Member

It will be included in 2.5.1 release, which is planned to release this week.

@kemburi

kemburi commented Mar 31, 2020

Copy link
Copy Markdown

we need to test this as soon as possible, is there any intermitent bits kind of beta which can be refered for testing the changes?

@sijie

sijie commented Mar 31, 2020

Copy link
Copy Markdown
Member

@kemburi :

you can use our weekly build: https://github.com/streamnative/pulsar/releases/tag/v2.6.0-347d3851b

You can reference the build jar here:

<repositories>
    <repository>
      <id>central</id>
      <layout>default</layout>
      <url>https://repo1.maven.org/maven2</url>
    </repository>
    <repository>
      <id>bintray-streamnative-maven</id>
      <name>bintray</name>
      <url>https://dl.bintray.com/streamnative/maven</url>
    </repository>
  </repositories>

Use the version 2.6.0-347d3851b.

tuteng pushed a commit that referenced this pull request Apr 6, 2020
### Motivation

Try to make user able to use both "org.bouncycastle.jce.provider.BouncyCastleProvider" and  "org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider".

Current code, bouncycastle (bc) jars  are used in both broker and client, and are tied strongly in both broker and client.  We need to make it easy config. This change try to split bc and module that depends on it. Then user could freely include/exclude it.

### Changes
- build a shaded jar for bouncycastle non-fips version. other module depends on this module.
- build nar for both fips and non-fips version of bouncycastle, user could able to load bouncycastle by these 2 nar.
- split MessageCrypto out from client and made it an individual module.  so client is able to exclude bouncycastle.
- Add 2 test examples:  1, exclude bc-non-fips version, and include bc-fips version; 2, exclude bc-non-fips version and load bc-fips version by nar.


(cherry picked from commit 181e5e7)
tuteng pushed a commit that referenced this pull request Apr 13, 2020
### Motivation

Try to make user able to use both "org.bouncycastle.jce.provider.BouncyCastleProvider" and  "org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider".

Current code, bouncycastle (bc) jars  are used in both broker and client, and are tied strongly in both broker and client.  We need to make it easy config. This change try to split bc and module that depends on it. Then user could freely include/exclude it.

### Changes
- build a shaded jar for bouncycastle non-fips version. other module depends on this module.
- build nar for both fips and non-fips version of bouncycastle, user could able to load bouncycastle by these 2 nar.
- split MessageCrypto out from client and made it an individual module.  so client is able to exclude bouncycastle.
- Add 2 test examples:  1, exclude bc-non-fips version, and include bc-fips version; 2, exclude bc-non-fips version and load bc-fips version by nar.


(cherry picked from commit 181e5e7)
jiazhai added a commit to jiazhai/pulsar that referenced this pull request May 18, 2020
### Motivation

Try to make user able to use both "org.bouncycastle.jce.provider.BouncyCastleProvider" and  "org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider".

Current code, bouncycastle (bc) jars  are used in both broker and client, and are tied strongly in both broker and client.  We need to make it easy config. This change try to split bc and module that depends on it. Then user could freely include/exclude it.

### Changes
- build a shaded jar for bouncycastle non-fips version. other module depends on this module.
- build nar for both fips and non-fips version of bouncycastle, user could able to load bouncycastle by these 2 nar.
- split MessageCrypto out from client and made it an individual module.  so client is able to exclude bouncycastle.
- Add 2 test examples:  1, exclude bc-non-fips version, and include bc-fips version; 2, exclude bc-non-fips version and load bc-fips version by nar.

(cherry picked from commit 181e5e7)
huangdx0726 pushed a commit to huangdx0726/pulsar that referenced this pull request Aug 24, 2020
### Motivation

Try to make user able to use both "org.bouncycastle.jce.provider.BouncyCastleProvider" and  "org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider".

Current code, bouncycastle (bc) jars  are used in both broker and client, and are tied strongly in both broker and client.  We need to make it easy config. This change try to split bc and module that depends on it. Then user could freely include/exclude it.

### Changes
- build a shaded jar for bouncycastle non-fips version. other module depends on this module.
- build nar for both fips and non-fips version of bouncycastle, user could able to load bouncycastle by these 2 nar.
- split MessageCrypto out from client and made it an individual module.  so client is able to exclude bouncycastle.
- Add 2 test examples:  1, exclude bc-non-fips version, and include bc-fips version; 2, exclude bc-non-fips version and load bc-fips version by nar.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants