8307134: Add GTS root CAs #13754

jianglizhou · 2023-05-02T16:35:18Z

This PR was requested by awarner@google.com. The updates were provided by awarner@google.com.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8307134: Add GTS root CAs

Reviewers

Sean Mullan (@seanjmullan - Reviewer)
Rajan Halade (@rhalade - Reviewer)

Contributors

Andy Warner <awarner@google.com>
Rajan Halade <rhalade@openjdk.org>

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/13754/head:pull/13754
$ git checkout pull/13754

Update a local copy of the PR:
$ git checkout pull/13754
$ git pull https://git.openjdk.org/jdk.git pull/13754/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 13754

View PR using the GUI difftool:
$ git pr show -t 13754

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/13754.diff

Webrev

Link to Webrev Comment

bridgekeeper · 2023-05-02T16:36:06Z

👋 Welcome back jiangli! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2023-05-02T16:37:35Z

@jianglizhou The following label will be automatically applied to this pull request:

security

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2023-05-02T16:41:23Z

Webrevs

jianglizhou · 2023-05-02T16:44:30Z

/contributor add Andy Warner awarner@google.com

openjdk · 2023-05-02T16:45:05Z

@jianglizhou
Contributor Andy Warner <awarner@google.com> successfully added.

seanjmullan · 2023-05-02T17:25:35Z

Ideally, an infra test for testing test certs should also be added. @rhalade may be able to contribute this.

rhalade · 2023-05-02T17:29:07Z

I have infra tests for interop implemented. @jianglizhou, please check https://github.com/openjdk/jdk/compare/master...rhalade:jdk:googletrust-certify?expand=1

rhalade · 2023-05-02T17:29:36Z

src/java.base/share/data/cacerts/globalsigneccrootcar4

@@ -1,20 +1,19 @@
 Owner: CN=GlobalSign, O=GlobalSign, OU=GlobalSign ECC Root CA - R4
 Issuer: CN=GlobalSign, O=GlobalSign, OU=GlobalSign ECC Root CA - R4
-Serial number: 2a38a41c960a04de42b228a50be8349802
+Serial number: 203e57ef53f93fda50921b2a6


Why is this certificate changed?

The original R4 did not have the digitalSignature keyUsage set. This root signs OCSP responses, so it needed to be reissued to comply with section 7.1.2.1 of the CA/B Forum baseline requirements. The only change between the two versions aside from the serial number is the addition of the digitalSignature key usage bit.

Thanks for the explanation. Please file a different issue for this change, since it is outside the scope of this issue, which is to specifically add new roots that have been approved by the Java SE CA Root Program processes. Updated roots, even for small changes such as this, should be handled and approved using an equivalent process.

Reverted src/java.base/share/data/cacerts/globalsigneccrootcar4 in this PR. Looks like the update for "globalsigneccrootcar4 [jdk]" in test/jdk/sun/security/lib/cacerts/VerifyCACerts.java also needs to be reverted, otherwise the test fails with the following error. I'll go ahead and revert that as well.

ERROR: wrong checksum72:03:89:C2:7B:BF:87:87:E1:65:44:6E:43:5C:65:FF:B5:E8:F9:4C:8A:D1:63:6D:D1:91:4C:AD:1C:9A:CB:3B Expected checksum23:6E:7A:1C:37:AD:82:31:FD:32:E8:31:63:4B:1A:88:BA:1A:4D:F6:D3:91:CD:0F:B4:09:EC:55:9A:B2:01:51 ERROR: globalsigneccrootcar4 [jdk] SHA-256 fingerprint is incorrect java.lang.RuntimeException: At least one cacert test failed at VerifyCACerts.main(VerifyCACerts.java:380) at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103) at java.base/java.lang.reflect.Method.invoke(Method.java:578) at com.sun.javatest.regtest.agent.MainWrapper$MainTask.run(MainWrapper.java:138) at java.base/java.lang.Thread.run(Thread.java:1592)

Done. Also updated 'CHECKSUM' value in test/jdk/sun/security/lib/cacerts/VerifyCACerts.java reflectively.

jianglizhou · 2023-05-02T17:53:09Z

Ideally, an infra test for testing test certs should also be added. @rhalade may be able to contribute this.

Thanks!

jianglizhou · 2023-05-02T18:36:44Z

I have infra tests for interop implemented. @jianglizhou, please check https://github.com/openjdk/jdk/compare/master...rhalade:jdk:googletrust-certify?expand=1

@rhalade, thanks! I have a minor comment below for your test/jdk/security/infra/java/security/cert/CertPathValidator/certification/GoogleCA.java test. I'll defer to @awarner@google.com for detailed review, as I don't have much context.

Please fix the bug id, 8303394:

/*
 * @test
 * @bug 8303394
 * @summary Interoperability tests with Google's GlobalSign R4 and GTS Root certificates
 ...

Could you please also let me know your plan on committing the GoogleCA.java? Do you plan to create a PR?

rhalade · 2023-05-02T18:42:36Z

I have infra tests for interop implemented. @jianglizhou, please check https://github.com/openjdk/jdk/compare/master...rhalade:jdk:googletrust-certify?expand=1

@rhalade, thanks! I have a minor comment below for your test/jdk/security/infra/java/security/cert/CertPathValidator/certification/GoogleCA.java test. I'll defer to @awarner@google.com for detailed review, as I don't have much context.

Please fix the bug id, 8303394:
/*
 * @test
 * @bug 8303394
 * @summary Interoperability tests with Google's GlobalSign R4 and GTS Root certificates
 ...
Could you please also let me know your plan on committing the GoogleCA.java? Do you plan to create a PR?

You can include this contribution in your PR. Then it will be easier to backport to JDK 20u as one changeset. I updated bug id in the changeset.

aww-aww · 2023-05-02T19:00:15Z

I have infra tests for interop implemented. @jianglizhou, please check https://github.com/openjdk/jdk/compare/master...rhalade:jdk:googletrust-certify?expand=1

Aside from the bug number @jianglizhou raised, the interop tests look good to me.

jianglizhou · 2023-05-02T20:35:09Z

/contributor add rhalade

openjdk · 2023-05-02T20:36:02Z

@jianglizhou
Contributor Rajan Halade <rhalade@openjdk.org> successfully added.

jianglizhou · 2023-05-02T20:38:34Z

You can include this contribution in your PR. Then it will be easier to backport to JDK 20u as one changeset. I updated bug id in the changeset.

Done. Please double check.

I ran the GoogleCA.java test with a test JDK binary built with this PR changes included. The test passed.

…nge.

…erting src/java.base/share/data/cacerts/globalsigneccrootcar4.

seanjmullan

Looks good. Please also wait for approval from @rhalade before integrating.

openjdk · 2023-05-03T13:13:22Z

@jianglizhou This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8307134: Add GTS root CAs

Co-authored-by: Andy Warner <awarner@google.com>
Co-authored-by: Rajan Halade <rhalade@openjdk.org>
Reviewed-by: mullan, rhalade

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 17 new commits pushed to the master branch:

3930709: 8068925: Add @OverRide in javax.tools classes
fc76687: 8306836: Remove pinned tag for G1 heap regions
ccf91f8: 8306933: C2: "assert(false) failed: infinite loop" failure
e9807a4: 8306042: C2: failed: Missed optimization opportunity in PhaseCCP (adding LShift->Cast->Add notification)
fcb280a: 8305092: Improve Thread.sleep(millis, nanos) for sub-millisecond granularity
891530f: 8307005: Make CardTableBarrierSet::initialize non-virtual
e0774be: 8306997: C2: "malformed control flow" assert due to missing safepoint on backedge with a switch
462b1df: 8307106: Allow concurrent GCs to walk CLDG without ClassLoaderDataGraph_lock
c8f3756: 8306729: Add nominal descriptors of modules and packages to Constants API
0b5b642: 8307150: RISC-V: Remove remaining StoreLoad barrier with UseCondCardMark for Serial/Parallel GC
... and 7 more: https://git.openjdk.org/jdk/compare/a8bf2acb7db63b508ef169e42a27b9c99178cbb1...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

jianglizhou · 2023-05-03T16:12:17Z

Looks good. Please also wait for approval from @rhalade before integrating.

Thanks @seanjmullan. Will wait for @rhalade's approval as well.

rhalade

Looks good to me. Please don't forget to update the release note and backport to JDK 20u.

jianglizhou · 2023-05-03T21:07:40Z

Looks good to me. Please don't forget to update the release note and backport to JDK 20u.

Thanks @rhalade. Will do.

jianglizhou · 2023-05-03T21:07:52Z

/integrate

openjdk · 2023-05-03T21:09:32Z

Going to push as commit 03030d4.
Since your change was applied there have been 22 commits pushed to the master branch:

63cd0a3: 4200096: OffScreenImageSource.removeConsumer NullPointerException
db8b3cd: 8305963: Typo in java.security.Security.getProperty
dcb2f3f: 8306320: BufferedImage spec needs clarification w.r.t its implementation of the WritableRenderedImage interface
1487477: 8305815: Update Libpng to 1.6.39
705ad7d: 8306014: Update javax.net.ssl TLS tests to use SSLContextTemplate or SSLEngineTemplate
3930709: 8068925: Add @OverRide in javax.tools classes
fc76687: 8306836: Remove pinned tag for G1 heap regions
ccf91f8: 8306933: C2: "assert(false) failed: infinite loop" failure
e9807a4: 8306042: C2: failed: Missed optimization opportunity in PhaseCCP (adding LShift->Cast->Add notification)
fcb280a: 8305092: Improve Thread.sleep(millis, nanos) for sub-millisecond granularity
... and 12 more: https://git.openjdk.org/jdk/compare/a8bf2acb7db63b508ef169e42a27b9c99178cbb1...master

Your commit was automatically rebased without conflicts.

openjdk · 2023-05-03T21:09:43Z

@jianglizhou Pushed as commit 03030d4.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

jianglizhou added 2 commits May 1, 2023 11:43

8307134: Add GTS root CAs

e8a339b

Merge branch 'master' into JDK-8307134

caedc4e

openjdk bot added the rfr Pull request is ready for review label May 2, 2023

openjdk bot added the security security-dev@openjdk.org label May 2, 2023

rhalade reviewed May 2, 2023

View reviewed changes

Add GoogleCA.java test from @rhalade.

37538f5

jianglizhou added 2 commits May 2, 2023 13:53

Revert the src/java.base/share/data/cacerts/globalsigneccrootcar4 cha…

3abe98b

…nge.

Update test/jdk/sun/security/lib/cacerts/VerifyCACerts.java after rev…

ffc8032

…erting src/java.base/share/data/cacerts/globalsigneccrootcar4.

seanjmullan approved these changes May 3, 2023

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label May 3, 2023

rhalade approved these changes May 3, 2023

View reviewed changes

openjdk bot added the integrated Pull request has been integrated label May 3, 2023

openjdk bot closed this May 3, 2023

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review labels May 3, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8307134: Add GTS root CAs #13754

8307134: Add GTS root CAs #13754

jianglizhou commented May 2, 2023 •

edited by openjdk bot

Loading

bridgekeeper bot commented May 2, 2023

openjdk bot commented May 2, 2023

mlbridge bot commented May 2, 2023 •

edited

Loading

jianglizhou commented May 2, 2023

openjdk bot commented May 2, 2023

seanjmullan commented May 2, 2023

rhalade commented May 2, 2023 •

edited

Loading

rhalade May 2, 2023

aww-aww May 2, 2023 •

edited by bridgekeeper bot

Loading

seanjmullan May 2, 2023

jianglizhou May 2, 2023

jianglizhou May 2, 2023

jianglizhou commented May 2, 2023

jianglizhou commented May 2, 2023

rhalade commented May 2, 2023

aww-aww commented May 2, 2023

jianglizhou commented May 2, 2023

openjdk bot commented May 2, 2023

jianglizhou commented May 2, 2023

seanjmullan left a comment

openjdk bot commented May 3, 2023 •

edited

Loading

jianglizhou commented May 3, 2023

rhalade left a comment

jianglizhou commented May 3, 2023

jianglizhou commented May 3, 2023

openjdk bot commented May 3, 2023

openjdk bot commented May 3, 2023

8307134: Add GTS root CAs #13754

8307134: Add GTS root CAs #13754

Conversation

jianglizhou commented May 2, 2023 • edited by openjdk bot Loading

Progress

Issue

Reviewers

Contributors

Reviewing

Webrev

bridgekeeper bot commented May 2, 2023

openjdk bot commented May 2, 2023

mlbridge bot commented May 2, 2023 • edited Loading

Webrevs

jianglizhou commented May 2, 2023

openjdk bot commented May 2, 2023

seanjmullan commented May 2, 2023

rhalade commented May 2, 2023 • edited Loading

rhalade May 2, 2023

Choose a reason for hiding this comment

aww-aww May 2, 2023 • edited by bridgekeeper bot Loading

Choose a reason for hiding this comment

seanjmullan May 2, 2023

Choose a reason for hiding this comment

jianglizhou May 2, 2023

Choose a reason for hiding this comment

jianglizhou May 2, 2023

Choose a reason for hiding this comment

jianglizhou commented May 2, 2023

jianglizhou commented May 2, 2023

rhalade commented May 2, 2023

aww-aww commented May 2, 2023

jianglizhou commented May 2, 2023

openjdk bot commented May 2, 2023

jianglizhou commented May 2, 2023

seanjmullan left a comment

Choose a reason for hiding this comment

openjdk bot commented May 3, 2023 • edited Loading

jianglizhou commented May 3, 2023

rhalade left a comment

Choose a reason for hiding this comment

jianglizhou commented May 3, 2023

jianglizhou commented May 3, 2023

openjdk bot commented May 3, 2023

openjdk bot commented May 3, 2023

jianglizhou commented May 2, 2023 •

edited by openjdk bot

Loading

mlbridge bot commented May 2, 2023 •

edited

Loading

rhalade commented May 2, 2023 •

edited

Loading

aww-aww May 2, 2023 •

edited by bridgekeeper bot

Loading

openjdk bot commented May 3, 2023 •

edited

Loading