Is netty-pkitesting a live dependency or test-only?

[civilizeddev]

Hi Netty team,

I have a question about the netty-pkitesting module.

netty/pkitesting/pom.xml

Line 26 in 243863c

<artifactId>netty-pkitesting</artifactId>

Is this module intended to be a runtime (library) dependency, or should it be considered test-only?

The reason I ask is that when I run jdeps against a JAR that has netty-pkitesting on the classpath, it fails with errors like:

Error: Module org.bouncycastle.provider not found, required by io.netty.pkitesting

If netty-pkitesting is indeed a runtime dependency, would it be possible to declare its dependencies on BouncyCastle, for example:

netty/pkitesting/pom.xml

Lines 41 to 48 in 243863c

	<dependency>
	<groupId>org.bouncycastle</groupId>
	<artifactId>bcpkix-jdk18on</artifactId>
	</dependency>
	<dependency>
	<groupId>org.bouncycastle</groupId>
	<artifactId>bcprov-jdk18on</artifactId>
	</dependency>

with <scope>provided</scope> so that tools like jdeps do not fail?

For context: we are not using BouncyCastle directly. This error appeared after upgrading Netty in zio-http#3507, where you can see the change here:

https://github.com/zio/zio-http/pull/3507/files#diff-ad2642dc77b3679e4ad2c7d3b2f59a2dcf48c1bf5b93a558a4fa44828315a34cL5

Could you please help clarify this?

Thanks in advance!

[yawkat]

Since it is a new module, probably nobody used it with JPMS yet. Feel free to fix compatibility.

[civilizeddev]

I think this issue should actually be addressed on the zio-http side, by changing the dependency on netty-pkitesting to use test scope.

https://github.com/zio/zio-http/blob/f2f10679fa781eb4f90392acee710c263a664785/project/Dependencies.scala#L31

Before opening a PR there, I just wanted to confirm with you: is netty-pkitesting indeed meant to be used only for test purposes, not as a runtime library dependency?

Thanks for clarifying!

[yawkat]

Before opening a PR there, I just wanted to confirm with you: is netty-pkitesting indeed meant to be used only for test purposes, not as a runtime library dependency?

No. And it doesn't look like zio uses it as a test dependency only

[civilizeddev]

https://github.com/zio/zio-http/blob/f2f10679fa781eb4f90392acee710c263a664785/zio-http/jvm/src/main/scala/zio/http/netty/server/ServerSSLDecoder.scala#L41

netty/pkitesting/src/main/java/module-info.yml

Line 19 in 243863c

- module: org.bouncycastle.provider

Yes, that’s right. In zio-http, if the server is running in TLS/SSL mode, it will end up accessing netty-pkitesting.

Then I’ll just exclude netty-pkitesting on my side and use it that way.
Thanks for clarifying!

[chrisvest]

It kind of is only intended for testing TLS and PKI stuff, as the name implies. That's also how Zio is trying to use it (see https://github.com/zio/zio-http/blob/main/zio-http/shared/src/main/scala/zio/http/SSLConfig.scala#L192-L196) though they do it in a way that makes netty-pkitesting a runtime dependency.

They should instead leave the test cert generation to either their downstream or to a separate test-specific module. In either case, clients and servers need to know about the runtime generated root certificate that you'd use netty-pkitesting to generate.

No reasonable client would trust the unknown self-signed cert they generate, which is also missing server authentication key usage, and a SAN.

[yawkat]

Yea it should probably be an optional dependency. I don't know enough about sbt to tell whether it is.