Open Hub
Open Hub

 Settings

1
I Use This!
Very High Activity

Commits : Listings

Analyzed about 24 hours ago. based on code collected 2 days ago.
Nov 06, 2025 — Nov 06, 2026
Commit Message Contributor Files Modified Lines Added Lines Removed Code Location Date
Require the component key that issued a third-party certification or trust delegation to hold the certification key flag when the signature was made, so that a SIGN_DATA-only subkey is no longer attributed the issuing certificate's authority to bind identities and delegate introducer trust.
David Hook
More... 3 months ago
Drop the duplicated C509 entry from the 1.86 additional-features list, keeping the copy that names org.bouncycastle.cbor.c509 as the package the new value types live in rather than the org.bouncycastle.c509 of the stale one.
David Hook
More... 3 months ago
Bound the C509 validity fields to the X.509 time domain when parsing and route every seconds-to-milliseconds conversion through one checked helper, so that a validityNotAfter displaced by 2^61 seconds - which reconstructs the same DER TBSCertificate and so leaves the issuer signature intact - is refused rather than read back as an expiry the holder's isValidOn and its own getters disagree about.
David Hook
More... 3 months ago
Record in the jdk1.4 build notes that no bctest include glob reaches a test living in the org.bouncycastle.tls package itself, that bctls does not take the matching contamination because its own copy excludes tests at any depth, and that a targeted include therefore buys a compile-floor check rather than a run, the package's AllTests being excluded from the staged sources.
David Hook
More... 3 months ago
Include SpreadCertificateStatusTest in the legacy Ant bctest copy, the shallow include globs reaching no test that lives directly in the org.bouncycastle.tls package, so that the real 1.4 javac compiles it rather than the class being dropped from the distribution unseen, relates to github #1485.
David Hook
More... 3 months ago
Surface a TLS 1.3 server's OCSP staples to a low-level client through the new TlsServerCertificate.getCertificateStatusAt, reading the per-CertificateEntry status_request extensions of RFC 8446 sec. 4.4.2.1 as the inverse of what a BC server writes, and answering the same way from the certificate_status message up to TLS 1.2, so that getCertificateStatus no longer returns null for every TLS 1.3 handshake and the BCJSSE provider shares the one implementation rather than carrying its own, relates to github #1485.
David Hook
More... 3 months ago
Reference github #1485 in the BCJSSE OCSP stapling release note, the client-side TLS 1.3 staple read it asked for having arrived with the server-side stapling work, relates to github #1485.
David Hook
More... 3 months ago
Require the signed-message envelope handed to AIMerSigner.verifySignature to be exactly the message plus the parameter set's signature size, so that a short signature is reported as a failed verification rather than indexed past its end, and a valid one with data appended to it no longer verifies, relates to github #2401.
David Hook
More... 3 months ago
Bump actions/checkout to v7 and github/codeql-action to v4 in the CodeQL workflow, taking the Node 24 runtime majors ahead of the CodeQL Action v3 deprecation due in December 2026, relates to github #2399.
David Hook
More... 3 months ago
Take the MLS interop harness gRPC and protobuf dependencies by Maven coordinate at gRPC 1.83.1 and protobuf-java 3.25.9 rather than as jars hand-placed under test/libs, clearing CVE-2024-7246, CVE-2025-55163 and CVE-2024-7254, and dropping the twelve superseded jars a dependency scanner could not see.
David Hook
More... 3 months ago
Move the MLS gRPC interop test harness out of the published mls module into the non-publishing misc one as org.bouncycastle.mls.examples.client, taking mls_client.proto and the protobuf codegen with it, so that bcmls no longer ships classes needing io.grpc and com.google.protobuf from a jar whose POM and OSGi manifest declare neither.
David Hook
More... 3 months ago
Cast the generic list reads in TlsStatusRequestResumptionTest so that it still compiles once the legacy Ant source preprocessor has stripped the generics from the fields.
David Hook
More... 3 months ago
Strip a bare wildcard type argument in the legacy Ant source preprocessor, so that a Class<?> parameter no longer fails the real 1.4 javac, the existing alternation having required at least one character before the closing angle bracket.
David Hook
More... 3 months ago
Remove the unreachable RFC 3281 attribute certificate cert-path services - the RFC3281 CertPathBuilder and CertPathValidator registrations, PKIXAttrCertPathBuilderSpi, PKIXAttrCertPathValidatorSpi, RFC3281CertPathUtilities and the attribute certificate signature check left with no caller - which have been uncallable since 1.52 because the X509AttributeCertStoreSelector they require cannot be carried by the PKIXExtendedParameters they read it back from.
David Hook
More... 3 months ago
Add a CertPathBuilder reuse test, covering that the failure recorded by one build is no longer reported by the next and that a successful build leaves nothing behind, exercising both the SPI the provider registers and the plain PKIXCertPathBuilderSpi it only hands out where PKIXRevocationChecker is absent.
David Hook
More... 3 months ago
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
David Hook
More... 3 months ago
Add server-side OCSP stapling to the BCJSSE provider and the low-level TLS API, answering status_request and status_request_v2 with a certificate_status message for TLSv1.2 and, from the same TlsServer.getCertificateStatus callback, a per-CertificateEntry extension for TLSv1.3, behind jdk.tls.server.enableStatusRequestExtension and a per-SSLContext response cache, dropping the echoes a resumed handshake would otherwise replay, reading the TLSv1.3 form on the client, dropping a response too large for its CertificateEntry to carry rather than failing the handshake over it, and clearing the status_request_v2 and trusted_ca_keys a reused TlsServer would otherwise carry into a following handshake, relates to github #1157.
David Hook
More... 3 months ago
Update DTLSReassembler following bc-csharp
Peter Dettman
More... 3 months ago
Add a weekly grouped Dependabot configuration covering the Gradle sub-project build files and GitHub Actions, with major-version bumps left to be raised by hand, relates to github #883.
David Hook
More... 3 months ago
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
David Hook
More... 3 months ago
Report the algorithm when a KEM has no registered encapsulation length rather than dereferencing a null table entry, and enable Classic McEliece as a CMS RFC 9629 KEMRecipientInfo recipient by registering the encapsulation lengths for its sixteen ISO/IEC 18033-2 parameter sets, relates to github #2398.
David Hook
More... 3 months ago
Add .vscode/ to .gitignore
Peter Dettman
More... 3 months ago
PKIX: Fix reuse in CertPath builders
Peter Dettman
More... 3 months ago
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
David Hook
More... 3 months ago
Rename the jdk17 HQC KEM test from HQC17Test to HQCKEM17Test so it follows the same *KEM17Test convention as the other nine KEM families, updating its AllTests17 registration.
David Hook
More... 3 months ago
BCJSSE: Don't restrict signature schemes by supported groups in TLS 1.3
Peter Dettman
More... 3 months ago
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
David Hook
More... 3 months ago
Eliminate five javac deprecation/unchecked warnings in test suites.
gefeili
More... 3 months ago
Merge branch 'main' of gitlab.cryptoworkshop.com:root/bc-java
David Hook
More... 3 months ago
Refactor kem prov17
gefeili
More... 3 months ago