8267880: Upgrade the default PKCS12 MAC algorithm

[GoeLin]

I backport this for parity with 11.0.17-oracle.

In 11.0.12, "JDK-8153005 Upgrade the default PKCS12 encryption/MAC algorithms" was pushed.
Some parts of it were reverted right away in "JDK-8267599 Revert the change to the default PKCS12 macAlgorithm and macIterationCount props for 11u/8u/7u".
This change now again enables 8153005. It is basically the reverse patch of 8267599,
where ParamsTest.java has been renamed to KeytoolOpensslInteropTest.java.

---

Progress

• Change must be properly reviewed (1 review required, with at least 1 Reviewer)
• Change must not contain extraneous whitespace
• Commit message must refer to an issue

Issue

• JDK-8267880: Upgrade the default PKCS12 MAC algorithm ⚠️ Issue is not open.

Reviewers

• Matthias Baesken (@MBaesken - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk11u-dev pull/1296/head:pull/1296
$ git checkout pull/1296

Update a local copy of the PR:
$ git checkout pull/1296
$ git pull https://git.openjdk.org/jdk11u-dev pull/1296/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 1296

View PR using the GUI difftool:
$ git pr show -t 1296

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk11u-dev/pull/1296.diff

[bridgekeeper]

👋 Welcome back goetz! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

[mlbridge]

Webrevs

• 01: Full - Incremental (ca4059d3)
• 00: Full (cfab0608)

[openjdk-notifier]

@GoeLin Please do not rebase or force-push to an active PR as it invalidates existing review comments. All changes will be squashed into a single commit automatically when integrating. See OpenJDK Developers’ Guide for more information.

[MBaesken]

LGTM,
but be aware of the issues described here https://bugs.openjdk.org/browse/JDK-8267599

[openjdk]

@GoeLin This change now passes all automated pre-integration checks.

After integration, the commit message for the final commit will be:

8267880: Upgrade the default PKCS12 MAC algorithm

Reviewed-by: mbaesken

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 5 new commits pushed to the master branch:

• 8871303: 8282933: Create a test for JDK-4529616
• 1ab3f82: 8283507: Create a regression test for RFE 4287690
• 1533520: 8283621: Write a regression test for CCC4400728
• b235f51: 8283623: Create an automated regression test for JDK-4525475
• 5a0824b: 8269039: Disable SHA-1 Signed JARs

Please see this link for an up-to-date comparison between the source branch of this pull request and the master branch.
As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

[GoeLin]

Thanks for the review.
Obviously this again introduces the incompatibilities this had been backed out for. But given the security roadmap and the fact that this comes in 7, 8 and 11 of Oracle I think this is bearable.
Also, for 5 releases (11.0.12 to 11.0.17) there was the chance to adapt applications.

[GoeLin]

/integrate

[openjdk]

Going to push as commit 9cf9879.
Since your change was applied there have been 6 commits pushed to the master branch:

• e80c7e1: 8238268: Many SA tests are not running on OSX because they do not attempt to use sudo when available
• 8871303: 8282933: Create a test for JDK-4529616
• 1ab3f82: 8283507: Create a regression test for RFE 4287690
• 1533520: 8283621: Write a regression test for CCC4400728
• b235f51: 8283623: Create an automated regression test for JDK-4525475
• 5a0824b: 8269039: Disable SHA-1 Signed JARs

Your commit was automatically rebased without conflicts.

[openjdk]

@GoeLin Pushed as commit 9cf9879.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.