Open Hub
Open Hub

 Settings

1
I Use This!
Very High Activity

Commits : Listings

Analyzed 1 day ago. based on code collected 2 days ago.
Nov 06, 2025 — Nov 06, 2026
Commit Message Contributor Files Modified Lines Added Lines Removed Code Location Date
Default version 6 OnePassSignaturePacket to the new OpenPGP packet format on generation (mirroring the v6 SignaturePacket constructor) so a v6 OPS packet emitted via PGPSignatureGenerator under the default ROUNDTRIP encoding no longer gets a Legacy header, per RFC 9580 sec. 4.2; v3 OPS keeps the Legacy default, relates to github #2347.
David Hook
More... 4 months ago
Cap the declared OpenPGP signature subpacket length at SignaturePacket.MAX_SUBPACKET_LEN before allocating, matching UserAttributeSubpacketInputStream, so a length read from a raw non-seekable stream (where the limit guard degrades to Integer.MAX_VALUE) cannot drive an oversized allocation.
David Hook
More... 4 months ago
Cap the declared OpenPGP signature subpacket length at SignaturePacket.MAX_SUBPACKET_LEN before allocating, matching UserAttributeSubpacketInputStream, so a length read from a raw non-seekable stream (where the limit guard degrades to Integer.MAX_VALUE) cannot drive an oversized allocation.
David Hook
More... 4 months ago
Derive OpenPGPCertificate subkey/key expiry only from a cryptographically valid self-signature so a forged binding advertising never-expires cannot override a genuine expiry, and note the legacy PGPPublicKey.getValidSeconds values are unverified.
David Hook
More... 4 months ago
Derive OpenPGPCertificate subkey/key expiry only from a cryptographically valid self-signature so a forged binding advertising never-expires cannot override a genuine expiry, and note the legacy PGPPublicKey.getValidSeconds values are unverified.
David Hook
More... 4 months ago
Brought the JPMS module descriptors and OSGi Export-Package headers back in step with the shipped packages: bcprov's module-info gains the missing ecjpake, hash2curve, ldap and keystore.util exports and asn1.mod/apache.bzip2 are now exported by bcutil/bcpg alongside oer.its and the openpgp.api subpackages, the ext-jdk1.9 descriptor is resynced to be identical with jdk1.9, and the bcpkix/bcutil OSGi package lists pick up cades and asn1.mod.
David Hook
More... 4 months ago
Brought the JPMS module descriptors and OSGi Export-Package headers back in step with the shipped packages: bcprov's module-info gains the missing ecjpake, hash2curve, ldap and keystore.util exports and asn1.mod/apache.bzip2 are now exported by bcutil/bcpg alongside oer.its and the openpgp.api subpackages, the ext-jdk1.9 descriptor is resynced to be identical with jdk1.9, and the bcpkix/bcutil OSGi package lists pick up cades and asn1.mod.
David Hook
More... 4 months ago
1.85 release notes - with CVE listing
David Hook
More... 4 months ago
1.85 release notes - with CVE listing
David Hook
More... 4 months ago
Extended the generateCbom fallback primitive classification to cover the OID-only KeyGenerator registrations (SM4/ARIA GCM-CCM, ARIA and DSTU7624 key wrap, SEED CMS wrap, DSTU7624 GMAC, legacy AES OIDs) and the generic EC keypair generator, removing the last unknown-primitive assets from the CBOM.
David Hook
More... 4 months ago
Extended the generateCbom fallback primitive classification to cover the OID-only KeyGenerator registrations (SM4/ARIA GCM-CCM, ARIA and DSTU7624 key wrap, SEED CMS wrap, DSTU7624 GMAC, legacy AES OIDs) and the generic EC keypair generator, removing the last unknown-primitive assets from the CBOM.
David Hook
More... 4 months ago
deleted unnecessary file
David Hook
More... 4 months ago
deleted unnecessary file
David Hook
More... 4 months ago
Exercise the SPHINCS+ OID encode/decode round-trip for the -simple variants in SphincsPlusTest (and its jdk1.3 mirror): the OIDs were already wired, so the FIXME skip was stale; add parameter-identity assertions to catch future OID/parameter mapping regressions, relates to github #2345.
David Hook
More... 4 months ago
Exercise the SPHINCS+ OID encode/decode round-trip for the -simple variants in SphincsPlusTest (and its jdk1.3 mirror): the OIDs were already wired, so the FIXME skip was stale; add parameter-identity assertions to catch future OID/parameter mapping regressions, relates to github #2345.
David Hook
More... 4 months ago
Fixed an off-by-4 header-length guard in NotationData.verifyData: the OpenPGP notation subpacket header is 8 octets, so a body declaring more name/value than it carried passed the check and overran in getNotationName/getNotationValueBytes; now counts the full header, relates to github #2346.
David Hook
More... 4 months ago
Fixed an off-by-4 header-length guard in NotationData.verifyData: the OpenPGP notation subpacket header is 8 octets, so a body declaring more name/value than it carried passed the check and overran in getNotationName/getNotationValueBytes; now counts the full header, relates to github #2346.
David Hook
More... 4 months ago
Replaced the CMS SignedData version-preservation property with a CMSSignedData.asVersion(int) method that returns a copy with the version field forced, so a producer (e.g. Authenticode needing version 1) can pin it explicitly per-instance while replaceSigners/addDigestAlgorithm keep recomputing the RFC 5652 version by default, relates to github #2344.
David Hook
More... 4 months ago
Replaced the CMS SignedData version-preservation property with a CMSSignedData.asVersion(int) method that returns a copy with the version field forced, so a producer (e.g. Authenticode needing version 1) can pin it explicitly per-instance while replaceSigners/addDigestAlgorithm keep recomputing the RFC 5652 version by default, relates to github #2344.
David Hook
More... 4 months ago
Made the X509RevocationChecker soft-fail hard limit inclusive (failHardMaxTime <= elapsed) to match the javadoc and hard-fail at exactly maxTime; removes the same-millisecond flakiness that RevocationTest.testRevokedEndEntityWithSoftFailure papered over with a 1s Thread.sleep, now dropped.
David Hook
More... 4 months ago
Made the X509RevocationChecker soft-fail hard limit inclusive (failHardMaxTime <= elapsed) to match the javadoc and hard-fail at exactly maxTime; removes the same-millisecond flakiness that RevocationTest.testRevokedEndEntityWithSoftFailure papered over with a 1s Thread.sleep, now dropped.
David Hook
More... 4 months ago
Give RevocationTest's eeCertWithDistPoint a valid non-empty CRL distribution point so it survives the empty-SEQUENCE CRLDistPoint hardening, relates to github #2331.
gefeili
More... 4 months ago
Give RevocationTest's eeCertWithDistPoint a valid non-empty CRL distribution point so it survives the empty-SEQUENCE CRLDistPoint hardening, relates to github #2331.
gefeili
More... 4 months ago
Credited digi-scrypt in CONTRIBUTORS and added a release note for the KMIPInputStream XXE (DTD/external-entity) hardening, relates to github #2315.
David Hook
More... 4 months ago
Credited digi-scrypt in CONTRIBUTORS and added a release note for the KMIPInputStream XXE (DTD/external-entity) hardening, relates to github #2315.
David Hook
More... 4 months ago
Reject empty SEQUENCE in the RFC 5280 SEQUENCE SIZE (1..MAX) X.509 extension parsers CertificatePolicies, PolicyMappings, ExtendedKeyUsage, CRLDistPoint and SubjectDirectoryAttributes, matching AuthorityInformationAccess/NameConstraints, relates to github #2331.
David Hook
More... 4 months ago
Reject empty SEQUENCE in the RFC 5280 SEQUENCE SIZE (1..MAX) X.509 extension parsers CertificatePolicies, PolicyMappings, ExtendedKeyUsage, CRLDistPoint and SubjectDirectoryAttributes, matching AuthorityInformationAccess/NameConstraints, relates to github #2331.
David Hook
More... 4 months ago
Harden asn1.cms.SignerInfo decode to reject a non-INTEGER version or non-tagged unsignedAttrs with IllegalArgumentException instead of leaking a ClassCastException, decoding via getInstance to match asn1.pkcs.SignerInfo, relates to github #2342.
David Hook
More... 4 months ago
Harden asn1.cms.SignerInfo decode to reject a non-INTEGER version or non-tagged unsignedAttrs with IllegalArgumentException instead of leaking a ClassCastException, decoding via getInstance to match asn1.pkcs.SignerInfo, relates to github #2342.
David Hook
More... 4 months ago
Fixed keybox Blob.getInstance treating an EMPTY_BLOB as end-of-file, silently dropping key blobs that follow a free/deleted slot; empty blobs are now skipped and parsing continues, relates to github #2343.
David Hook
More... 4 months ago