Sandor Molnar created KNOX-3555:
-----------------------------------
Summary: Bump bcpkix-jdk18on to 1.85 to align BouncyCastle versions
Key: KNOX-3555
URL: https://issues.apache.org/jira/browse/KNOX-3555
Project: Apache Knox
Issue Type: Task
Components: Server
Reporter: Sandor Molnar
Assignee: Sandor Molnar
Fix For: 3.1.0
Dependabot [PR #1418|https://github.com/apache/knox/pull/1418] bumped
{{bcprov-jdk18on}} from 1.84 to 1.85, but {{bcpkix-jdk18on}} was left at 1.84:
{code:xml}
<bcprov-jdk18on.version>1.85</bcprov-jdk18on.version>
<bcpkix-jdk18on.version>1.84</bcpkix-jdk18on.version>
{code}
{{bcpkix-jdk18on}} 1.84 depends on {{bcutil-jdk18on}} 1.84, whose POM declares
{{bcprov-jdk18on}} 1.84. Maven's dependencyManagement overrides it, so the
build resolves and packages bcprov 1.85:
{noformat}
\- org.bouncycastle:bcpkix-jdk18on:jar:1.84:compile
\- org.bouncycastle:bcutil-jdk18on:jar:1.84:compile
\- (org.bouncycastle:bcprov-jdk18on:jar:1.85:compile - version managed
from 1.84; omitted for duplicate)
{noformat}
However:
* dependency scanners that read the declared dependency graph still report
{{bcprov-jdk18on}} 1.84;
* Knox ships a mixed BouncyCastle set (bcprov 1.85 with bcpkix/bcutil 1.84),
which BouncyCastle does not support - all BC modules are meant to be used at
the same release.
*Proposed change:* bump {{bcpkix-jdk18on}} to 1.85 ({{bcutil-jdk18on}} follows
transitively). Optionally, use a single BouncyCastle version property for
bcprov and bcpkix so the two can't be bumped independently again.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
