Skip to content
Java
Branch: master
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
src
.gitignore
Jenkinsfile Add Jenkinsfile to build on ci.j.i Oct 6, 2017
README.md
pom.xml [maven-release-plugin] prepare for next development iteration Aug 21, 2018

README.md

Jenkins Bouncy Castle API Plugin

JENKINS-35291

Dependency to multiple Bouncy Castle versions from jenkins core and plugins is causing problems due to the binary incompatibility between versions, the different supported algorithms, etc.

On Jenkins core 1.648, Bouncy Castle was bumped from version 1.47 to 1.54 as a result of a change in instance-identity module

Problems found:

  • Plugins running in Jenkins < 1.648 get 1.47 from the parent class loader (in the default class loading strategy). If they include a later version in their own classpath, only "new" classes are seen from their referenced JAR.
  • Plugins running in Jenkins >= 1.648 get 1.54 from the parent class loader (in the default class loading strategy). If they include an earlier version in their own classpath, only "removed" classes are seen from their referenced JAR.
  • If the plugin is using JCA instead of BC classes directly usually the plugin works, but if ran in an BC 1.47 Jenkins core, there will be missing algorithms.
  • Plugins are introducing different versions of BC which adds to de mix, potentially producing unpredictable results

Some considerations:

  • Many plugins are only introducing BC dependency to do PEM encoding/decoding. This API got changed by the BC bump.
  • instance-identity-module is using BC only for PEM encoding/decoding, removing this dependency from the core is possible

Proposed solution A possible solution to this problem would to create a plugin (this plugin) from which plugins using BC will depend. Responsible for:

  • Load BC into uber class loader.
  • Register BC as a JVM security provider in order to allow other plugins to use JCA API with BC algorithms.
  • Provide an API to do common tasks like PEM Encoding/Decoding ensuring its stability among BC versions.

The implementation of this plugin does not expose any classes from BC, only JCA, allowing plugins to not depend on the specifics of BC.

Later some other actions would have to be taken in order to fully solve this situation, like having one version of the plugin for each version of BC, etc.

This plugin provides an stable API to Bouncy Castle related tasks. Plugins using Bouncy Castle should depend on this plugin and not directly on Bouncy Castle. See also this plugin's wiki page

Environment

The following build environment is required to build this plugin

  • java-1.6 and maven-3.0.5

Build

To build the plugin locally:

mvn clean verify

Release

To release the plugin:

mvn release:prepare release:perform -B

Test local instance

To test in a local Jenkins instance

mvn hpi:run
You can’t perform that action at this time.