From 776bcbcbd43e745306c84e28b8cfe4e43163f31a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=A1clav=20Muzik=C3=A1=C5=99?= Date: Thu, 20 Jul 2023 11:57:18 +0200 Subject: [PATCH] Update bcpkix and bcprov dependencies (#21543) Closes #21360 --- adapters/oidc/adapter-core/pom.xml | 2 +- adapters/oidc/installed/pom.xml | 2 +- adapters/oidc/jakarta-servlet-filter/pom.xml | 2 +- adapters/oidc/jetty/jetty-core/pom.xml | 2 +- adapters/oidc/jetty/jetty9.4/pom.xml | 2 +- adapters/oidc/servlet-filter/pom.xml | 2 +- adapters/oidc/spring-security/pom.xml | 2 +- adapters/oidc/tomcat/tomcat-core/pom.xml | 2 +- adapters/oidc/tomcat/tomcat/pom.xml | 2 +- adapters/oidc/undertow/pom.xml | 2 +- adapters/oidc/wildfly-elytron/pom.xml | 2 +- adapters/saml/jakarta-servlet-filter/pom.xml | 2 +- adapters/saml/jetty/jetty-core/pom.xml | 2 +- adapters/saml/jetty/jetty9.4/pom.xml | 2 +- adapters/saml/servlet-filter/pom.xml | 2 +- adapters/saml/tomcat/tomcat-core/pom.xml | 2 +- adapters/saml/tomcat/tomcat/pom.xml | 2 +- adapters/spi/adapter-spi/pom.xml | 2 +- adapters/spi/jboss-adapter-core/pom.xml | 2 +- crypto/default/pom.xml | 4 ++-- dependencies/server-min/pom.xml | 4 ++-- .../feature-packs/adapter-feature-pack/pom.xml | 10 ++++++++++ .../client/admin/cli/util/ClassLoaderUtil.java | 2 +- integration/client-cli/client-cli-dist/assembly.xml | 2 +- integration/client-cli/client-cli-dist/pom.xml | 2 +- .../client/registration/cli/util/ClassLoaderUtil.java | 2 +- operator/pom.xml | 4 ++-- pom.xml | 11 ----------- .../mappers/ClassLoaderPropertyMappers.java | 2 +- .../junit5/src/main/java/org/keycloak/Keycloak.java | 4 ++-- .../adapter-spi/undertow-adapter-jakarta/pom.xml | 2 +- testsuite/integration-arquillian/tests/base/pom.xml | 4 ++-- testsuite/integration-arquillian/tests/pom.xml | 6 +++--- testsuite/utils/pom.xml | 4 ++-- 34 files changed, 50 insertions(+), 51 deletions(-) diff --git a/adapters/oidc/adapter-core/pom.xml b/adapters/oidc/adapter-core/pom.xml index fc339d314a..2baddd35d1 100755 --- a/adapters/oidc/adapter-core/pom.xml +++ b/adapters/oidc/adapter-core/pom.xml @@ -55,7 +55,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on provided diff --git a/adapters/oidc/installed/pom.xml b/adapters/oidc/installed/pom.xml index 5f9476fa91..985b81d485 100755 --- a/adapters/oidc/installed/pom.xml +++ b/adapters/oidc/installed/pom.xml @@ -45,7 +45,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on org.apache.httpcomponents diff --git a/adapters/oidc/jakarta-servlet-filter/pom.xml b/adapters/oidc/jakarta-servlet-filter/pom.xml index 01ec205e50..c2105f8e1e 100755 --- a/adapters/oidc/jakarta-servlet-filter/pom.xml +++ b/adapters/oidc/jakarta-servlet-filter/pom.xml @@ -81,7 +81,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on com.fasterxml.jackson.core diff --git a/adapters/oidc/jetty/jetty-core/pom.xml b/adapters/oidc/jetty/jetty-core/pom.xml index 75f187e937..f36d9780af 100755 --- a/adapters/oidc/jetty/jetty-core/pom.xml +++ b/adapters/oidc/jetty/jetty-core/pom.xml @@ -68,7 +68,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on com.fasterxml.jackson.core diff --git a/adapters/oidc/jetty/jetty9.4/pom.xml b/adapters/oidc/jetty/jetty9.4/pom.xml index ff4454ba86..3ddd0b2fa9 100644 --- a/adapters/oidc/jetty/jetty9.4/pom.xml +++ b/adapters/oidc/jetty/jetty9.4/pom.xml @@ -64,7 +64,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on com.fasterxml.jackson.core diff --git a/adapters/oidc/servlet-filter/pom.xml b/adapters/oidc/servlet-filter/pom.xml index 7cd29e60e8..1e26928aa9 100755 --- a/adapters/oidc/servlet-filter/pom.xml +++ b/adapters/oidc/servlet-filter/pom.xml @@ -73,7 +73,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on com.fasterxml.jackson.core diff --git a/adapters/oidc/spring-security/pom.xml b/adapters/oidc/spring-security/pom.xml index a72e321e86..c85b8180a2 100644 --- a/adapters/oidc/spring-security/pom.xml +++ b/adapters/oidc/spring-security/pom.xml @@ -89,7 +89,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on runtime diff --git a/adapters/oidc/tomcat/tomcat-core/pom.xml b/adapters/oidc/tomcat/tomcat-core/pom.xml index 2936f82aa7..b7859c0d7d 100755 --- a/adapters/oidc/tomcat/tomcat-core/pom.xml +++ b/adapters/oidc/tomcat/tomcat-core/pom.xml @@ -57,7 +57,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on com.fasterxml.jackson.core diff --git a/adapters/oidc/tomcat/tomcat/pom.xml b/adapters/oidc/tomcat/tomcat/pom.xml index ef54189b2a..2a5d961490 100755 --- a/adapters/oidc/tomcat/tomcat/pom.xml +++ b/adapters/oidc/tomcat/tomcat/pom.xml @@ -80,7 +80,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on com.fasterxml.jackson.core diff --git a/adapters/oidc/undertow/pom.xml b/adapters/oidc/undertow/pom.xml index d91c8eadf8..6d179ae84d 100755 --- a/adapters/oidc/undertow/pom.xml +++ b/adapters/oidc/undertow/pom.xml @@ -69,7 +69,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on com.fasterxml.jackson.core diff --git a/adapters/oidc/wildfly-elytron/pom.xml b/adapters/oidc/wildfly-elytron/pom.xml index f597b94cd1..8a51fc6b28 100755 --- a/adapters/oidc/wildfly-elytron/pom.xml +++ b/adapters/oidc/wildfly-elytron/pom.xml @@ -70,7 +70,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on com.fasterxml.jackson.core diff --git a/adapters/saml/jakarta-servlet-filter/pom.xml b/adapters/saml/jakarta-servlet-filter/pom.xml index ba65ff19ec..f7ee0ee6bc 100755 --- a/adapters/saml/jakarta-servlet-filter/pom.xml +++ b/adapters/saml/jakarta-servlet-filter/pom.xml @@ -59,7 +59,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on org.keycloak diff --git a/adapters/saml/jetty/jetty-core/pom.xml b/adapters/saml/jetty/jetty-core/pom.xml index de200d690b..7ad7075239 100755 --- a/adapters/saml/jetty/jetty-core/pom.xml +++ b/adapters/saml/jetty/jetty-core/pom.xml @@ -73,7 +73,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on org.eclipse.jetty diff --git a/adapters/saml/jetty/jetty9.4/pom.xml b/adapters/saml/jetty/jetty9.4/pom.xml index 57f610c81c..91e5589f0b 100644 --- a/adapters/saml/jetty/jetty9.4/pom.xml +++ b/adapters/saml/jetty/jetty9.4/pom.xml @@ -53,7 +53,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on org.keycloak diff --git a/adapters/saml/servlet-filter/pom.xml b/adapters/saml/servlet-filter/pom.xml index 1c7a330714..5fc0270429 100755 --- a/adapters/saml/servlet-filter/pom.xml +++ b/adapters/saml/servlet-filter/pom.xml @@ -49,7 +49,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on org.keycloak diff --git a/adapters/saml/tomcat/tomcat-core/pom.xml b/adapters/saml/tomcat/tomcat-core/pom.xml index ea6f4eb6c8..9844e59f09 100755 --- a/adapters/saml/tomcat/tomcat-core/pom.xml +++ b/adapters/saml/tomcat/tomcat-core/pom.xml @@ -53,7 +53,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on org.keycloak diff --git a/adapters/saml/tomcat/tomcat/pom.xml b/adapters/saml/tomcat/tomcat/pom.xml index 1be9994efd..0dd64f673b 100755 --- a/adapters/saml/tomcat/tomcat/pom.xml +++ b/adapters/saml/tomcat/tomcat/pom.xml @@ -72,7 +72,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on junit diff --git a/adapters/spi/adapter-spi/pom.xml b/adapters/spi/adapter-spi/pom.xml index d214608201..aab344d284 100755 --- a/adapters/spi/adapter-spi/pom.xml +++ b/adapters/spi/adapter-spi/pom.xml @@ -43,7 +43,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on provided diff --git a/adapters/spi/jboss-adapter-core/pom.xml b/adapters/spi/jboss-adapter-core/pom.xml index 63fcbce25d..a184ae5e0d 100755 --- a/adapters/spi/jboss-adapter-core/pom.xml +++ b/adapters/spi/jboss-adapter-core/pom.xml @@ -50,7 +50,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on com.fasterxml.jackson.core diff --git a/crypto/default/pom.xml b/crypto/default/pom.xml index 3a9745d982..2b0cf1fb23 100644 --- a/crypto/default/pom.xml +++ b/crypto/default/pom.xml @@ -56,11 +56,11 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on org.bouncycastle - bcpkix-jdk15on + bcpkix-jdk18on org.jboss.logging diff --git a/dependencies/server-min/pom.xml b/dependencies/server-min/pom.xml index 9c2ac21c55..8749833cd6 100755 --- a/dependencies/server-min/pom.xml +++ b/dependencies/server-min/pom.xml @@ -41,11 +41,11 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on org.bouncycastle - bcpkix-jdk15on + bcpkix-jdk18on org.keycloak diff --git a/distribution/feature-packs/adapter-feature-pack/pom.xml b/distribution/feature-packs/adapter-feature-pack/pom.xml index c76f58d7f2..cd9b1baf68 100755 --- a/distribution/feature-packs/adapter-feature-pack/pom.xml +++ b/distribution/feature-packs/adapter-feature-pack/pom.xml @@ -170,6 +170,16 @@ wildfly-feature-pack ${wildfly.version} zip + + + org.bouncycastle + bcprov-jdk15on + + + org.bouncycastle + bcpkix-jdk15on + + diff --git a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/util/ClassLoaderUtil.java b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/util/ClassLoaderUtil.java index 44d66072f3..990cf8182e 100644 --- a/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/util/ClassLoaderUtil.java +++ b/integration/client-cli/admin-cli/src/main/java/org/keycloak/client/admin/cli/util/ClassLoaderUtil.java @@ -38,7 +38,7 @@ public class ClassLoaderUtil { // Detect if BC FIPS jars are present in the "client/lib" directory boolean bcFipsJarPresent = Stream.of(jarsInDir).anyMatch(file -> file.getName().startsWith("bc-fips")); - String[] validJarPrefixes = bcFipsJarPresent ? new String[] {"keycloak-crypto-fips1402", "bc-fips", "bctls-fips"} : new String[] {"keycloak-crypto-default", "bcprov-jdk15on"}; + String[] validJarPrefixes = bcFipsJarPresent ? new String[] {"keycloak-crypto-fips1402", "bc-fips", "bctls-fips"} : new String[] {"keycloak-crypto-default", "bcprov-jdk18on"}; URL[] usedJars = Stream.of(jarsInDir) .filter(file -> { for (String prefix : validJarPrefixes) { diff --git a/integration/client-cli/client-cli-dist/assembly.xml b/integration/client-cli/client-cli-dist/assembly.xml index 42cb0f2d7f..cb56c0f331 100755 --- a/integration/client-cli/client-cli-dist/assembly.xml +++ b/integration/client-cli/client-cli-dist/assembly.xml @@ -60,7 +60,7 @@ org.keycloak:keycloak-crypto-default org.keycloak:keycloak-crypto-fips1402 - org.bouncycastle:bcprov-jdk15on + org.bouncycastle:bcprov-jdk18on keycloak-client-tools/bin/client/lib diff --git a/integration/client-cli/client-cli-dist/pom.xml b/integration/client-cli/client-cli-dist/pom.xml index 18245b5772..5712241f7d 100755 --- a/integration/client-cli/client-cli-dist/pom.xml +++ b/integration/client-cli/client-cli-dist/pom.xml @@ -60,7 +60,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on * diff --git a/integration/client-cli/client-registration-cli/src/main/java/org/keycloak/client/registration/cli/util/ClassLoaderUtil.java b/integration/client-cli/client-registration-cli/src/main/java/org/keycloak/client/registration/cli/util/ClassLoaderUtil.java index ffaeab8877..72e2b2f5f2 100644 --- a/integration/client-cli/client-registration-cli/src/main/java/org/keycloak/client/registration/cli/util/ClassLoaderUtil.java +++ b/integration/client-cli/client-registration-cli/src/main/java/org/keycloak/client/registration/cli/util/ClassLoaderUtil.java @@ -38,7 +38,7 @@ public class ClassLoaderUtil { // Detect if BC FIPS jars are present in the "client/lib" directory boolean bcFipsJarPresent = Stream.of(jarsInDir).anyMatch(file -> file.getName().startsWith("bc-fips")); - String[] validJarPrefixes = bcFipsJarPresent ? new String[] {"keycloak-crypto-fips1402", "bc-fips", "bctls-fips"} : new String[] {"keycloak-crypto-default", "bcprov-jdk15on"}; + String[] validJarPrefixes = bcFipsJarPresent ? new String[] {"keycloak-crypto-fips1402", "bc-fips", "bctls-fips"} : new String[] {"keycloak-crypto-default", "bcprov-jdk18on"}; URL[] usedJars = Stream.of(jarsInDir) .filter(file -> { for (String prefix : validJarPrefixes) { diff --git a/operator/pom.xml b/operator/pom.xml index 8d5c2367f9..b28548f5c6 100644 --- a/operator/pom.xml +++ b/operator/pom.xml @@ -101,11 +101,11 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on org.bouncycastle - bcpkix-jdk15on + bcpkix-jdk18on diff --git a/pom.xml b/pom.xml index 4f9ff33a34..704807462e 100644 --- a/pom.xml +++ b/pom.xml @@ -64,7 +64,6 @@ 0.66.19 4.5.14 1.5.1.Final - 1.70 1.0.7 @@ -353,16 +352,6 @@ xsom ${org.glassfish.jaxb.xsom.version} - - org.bouncycastle - bcprov-jdk15on - ${bouncycastle-bcprov-jdk15on.version} - - - org.bouncycastle - bcpkix-jdk15on - ${bouncycastle-bcprov-jdk15on.version} - org.bouncycastle bcpkix-fips diff --git a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ClassLoaderPropertyMappers.java b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ClassLoaderPropertyMappers.java index a46df7289c..2b622fe186 100644 --- a/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ClassLoaderPropertyMappers.java +++ b/quarkus/runtime/src/main/java/org/keycloak/quarkus/runtime/configuration/mappers/ClassLoaderPropertyMappers.java @@ -38,7 +38,7 @@ final class ClassLoaderPropertyMappers { if (profile.getFeatures().get(Feature.FIPS)) { ignoredArtifacts.addAll(List.of( - "org.bouncycastle:bcprov-jdk15on", "org.bouncycastle:bcpkix-jdk15on", "org.bouncycastle:bcutil-jdk15on", "org.keycloak:keycloak-crypto-default")); + "org.bouncycastle:bcprov-jdk18on", "org.bouncycastle:bcpkix-jdk18on", "org.bouncycastle:bcutil-jdk18on", "org.keycloak:keycloak-crypto-default")); } else { ignoredArtifacts.addAll(List.of( "org.keycloak:keycloak-crypto-fips1402", "org.bouncycastle:bc-fips", "org.bouncycastle:bctls-fips", "org.bouncycastle:bcpkix-fips")); diff --git a/quarkus/tests/junit5/src/main/java/org/keycloak/Keycloak.java b/quarkus/tests/junit5/src/main/java/org/keycloak/Keycloak.java index 8e9d492bab..ebf945e459 100644 --- a/quarkus/tests/junit5/src/main/java/org/keycloak/Keycloak.java +++ b/quarkus/tests/junit5/src/main/java/org/keycloak/Keycloak.java @@ -259,8 +259,8 @@ public class Keycloak { .addExclusion("org.jboss.logmanager", "log4j-jboss-logmanager"); if (fipsEnabled) { - serverDependency.addExclusion("org.bouncycastle", "bcprov-jdk15on"); - serverDependency.addExclusion("org.bouncycastle", "bcpkix-jdk15on"); + serverDependency.addExclusion("org.bouncycastle", "bcprov-jdk18on"); + serverDependency.addExclusion("org.bouncycastle", "bcpkix-jdk18on"); serverDependency.addExclusion("org.keycloak", "keycloak-crypto-default"); } else { serverDependency.addExclusion("org.keycloak", "keycloak-crypto-fips1402"); diff --git a/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-jakarta/pom.xml b/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-jakarta/pom.xml index 9904dc2dda..7539a2caf5 100644 --- a/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-jakarta/pom.xml +++ b/testsuite/integration-arquillian/servers/adapter-spi/undertow-adapter-jakarta/pom.xml @@ -57,7 +57,7 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on com.fasterxml.jackson.core diff --git a/testsuite/integration-arquillian/tests/base/pom.xml b/testsuite/integration-arquillian/tests/base/pom.xml index 4efc780e8f..a85e30f5af 100644 --- a/testsuite/integration-arquillian/tests/base/pom.xml +++ b/testsuite/integration-arquillian/tests/base/pom.xml @@ -56,8 +56,8 @@ keycloak-util-embedded-ldap - bouncycastle - bcprov-jdk15 + org.bouncycastle + bcprov-jdk15on diff --git a/testsuite/integration-arquillian/tests/pom.xml b/testsuite/integration-arquillian/tests/pom.xml index 3896d64ee0..7f2d9ac546 100644 --- a/testsuite/integration-arquillian/tests/pom.xml +++ b/testsuite/integration-arquillian/tests/pom.xml @@ -125,7 +125,7 @@ n -agentlib:jdwp=transport=dt_socket,server=y,suspend=${app.server.2.debug.suspend},address=localhost:${app.server.2.debug.port} 64m - 512m + 768m -Xms${app.server.memory.Xms} -Xmx${app.server.memory.Xmx} -XX:MetaspaceSize=${surefire.memory.metaspace} -XX:MaxMetaspaceSize=${surefire.memory.metaspace.max} false ${app.server.keystore.dir}/keycloak.truststore @@ -1810,11 +1810,11 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on org.bouncycastle - bcpkix-jdk15on + bcpkix-jdk18on org.hamcrest diff --git a/testsuite/utils/pom.xml b/testsuite/utils/pom.xml index 8118efa619..b487a2aa86 100755 --- a/testsuite/utils/pom.xml +++ b/testsuite/utils/pom.xml @@ -45,11 +45,11 @@ org.bouncycastle - bcprov-jdk15on + bcprov-jdk18on org.bouncycastle - bcpkix-jdk15on + bcpkix-jdk18on org.keycloak