v4.0.2

• Bug fixes

  • the header (--header) prints the key of an HMAC (-k resp. --key) in plain text in the
    line "invocation args", both for a command line and for parameters that have been set
    by the API (e.g. by a GUI); since files with a header are often kept or shared as check
    files, the secret leaked along with them; the key is shown as "password" now, which is
    how a key entered at the console is shown already, and which makes Jacksum ask for the
    key if the line is run again; the name of a key file (file:) is kept
  • a key (-k resp. --key) that cannot be decoded is quoted by the error message, either
    in full (dec:, oct:, bin:, z-base-32:) or in part (the first characters of hex:, or the
    part in front of a colon, if the key has no known type); the message names the type
    only now and says that the value is not shown; the messages for a key file (file:)
    and for option -q are unchanged
  • the license (--license), the copyright (--copyright), the CRC catalogue and the help
    (-h) are read with the platform's default charset rather than with UTF-8, so umlauts
    such as in the German help or in the copyright come out garbled if the default charset
    is not UTF-8 (e.g. -Dfile.encoding=COMPAT); GeneralIO.readLinesFromJarFile() ignored
    its charset parameter, and it threw a NullPointerException rather than the intended
    IOException for a resource that does not exist
  • GeneralString.trimRight() removed the leading whitespace and trimLeft() the trailing
    whitespace, i.e. the opposite of what their names say; they do what their names say
    now, which changes the behavior for API callers that relied on the old one
  • the copy constructor of CrcModelExtended passed the "include length" flag where the
    byte order of the length belongs, and it always switched on the inclusion of the
    length and its XOR, even if the model it copies has neither
  • the algorithm list of --info names SHA-384 as "SHA-2 familiy" instead of "SHA-2 family"
  • the documented alias whirlpool-1 of whirlpool1 was unknown, because it had been registered
    as "whirlpool-l" (lower case L instead of the digit 1); whirlpool-1 works now, and the
    undocumented whirlpool-l has been removed

• Updates

  • updated the bundled Bouncy Castle from 1.71/1.73 to 1.86 (digests only); the stripped copy
    is generated now by bouncycastle/update-bc.sh from the pristine sources
    plus a documented overlay and patch queue (see bouncycastle/README.md), it contains only the
    80 classes that Jacksum needs (it was 106); all hash values are unchanged
  • the bundled Bouncy Castle has been relocated from org.bouncycastle to
    net.jacksum.zzadopt.org.bouncycastle, so that it no longer clashes with a Bouncy Castle on the
    same classpath when Jacksum is used as a library (duplicate classes, split package); API users
    who used org.bouncycastle classes from the Jacksum jar must use their own Bouncy Castle now
  • Xoodyak and PHOTON-Beetle stay on Bouncy Castle 1.73's implementation, because Bouncy Castle
    1.86 fails the official LWC known answer tests for the empty message (Xoodyak) and for a
    16-byte message (PHOTON-Beetle)
  • kept the fix of Bouncy Castle's Blake2bpDigest that throws an ArrayIndexOutOfBoundsException
    or returns a wrong value for messages > 512 bytes that are fed in pieces (still present in 1.86)
  • KangarooTwelve and MarsupilamiFourteen request their output length (32 resp. 64 bytes) from
    the XOF now, rather than relying on Bouncy Castle 1.69's Kangaroo class, whose constructor
    parameter for the output length is ignored since Bouncy Castle 1.71
  • --info prints the block size (16 bytes) of esch256 and esch384 now
  • updated the adopted GNU Crypto classes from 2.0.1 to 2.1.0, the final release of GNU Crypto;
    Jacksum's own algorithms and modifications are kept and documented in
    net/jacksum/zzadopt/org/gnu/README.md; all hash values are unchanged
  • removed the unused copy of GNU Classpath's gnu.java.security hash functions
    (net.jacksum.zzadopt.gnu.java.security)
  • the adopted GNU Crypto classes have been moved from net.jacksum.zzadopt.gnu.crypto to
    net.jacksum.zzadopt.org.gnu.crypto, like the other adopted code that is sorted by the top
    level domain of its project; API users who used these classes directly must adapt their imports

• Documentation

  • the help of option -c and the use case "Is the medium still readable?" explain that a
    check right after a write, or a second run, may be served from the page cache of the
    operating system rather than from the medium, and how to empty that cache.
  • the API documentation (Javadoc) is complete for Jacksum's own packages now; the build
    reports a missing comment there again, while the adopted third-party code is not checked
  • --copyright names the correct license of the adopted FlexiProvider classes (LGPL-2.1 or
    later, as in FlexiProvider's own COPYING files, rather than GPL-2.0 or later) and DHA-256
    rather than "DSH-256"
  • the origin, the license and all modifications of the adopted FlexiProvider classes are
    documented in net/jacksum/zzadopt/de/flexiprovider/README.md; the names of their authors
    Martin Döring and Johannes Müller are spelled correctly again
  • --copyright lists all algorithms that come from sphlib (fr.cryptohash), and its copyright
    years match sphlib 3.0 (2007-2011); the origin and the modifications of the adopted sphlib
    classes, among them the round 2 IV of Hamsi-224, are documented in
    net/jacksum/zzadopt/fr/cryptohash/README.md
  • the comments of the adopted LSH classes (kr.re.nsr.crypto) are completely in English now; their
    origin, license and modifications are documented in net/jacksum/zzadopt/kr/README.md
  • the origin (Apache Commons Codec 1.15) and the license of the adopted XXHash32 class are
    documented in net/jacksum/zzadopt/org/apache/README.md; --copyright includes the attribution
    of Commons Codec's NOTICE file now, as the Apache License 2.0 requires
  • the help names the class that Jacksum's MDC2 is derived from (org.kapott.cryptalgs.MDC2 of
    HBCI4Java) rather than its former name org.kapott.hbci.security.MDC2; the origin, license and
    modifications of the adopted MDC2 class are documented in net/jacksum/zzadopt/org/kapott/README.md
  • the origin, license and modifications of the adopted BLAKE3 class (io.github.rctcwyvrn.blake3)
    are documented in net/jacksum/zzadopt/io/README.md