Set Bouncy Castle as optional feature in Gradle build #1006
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request assigns Bouncy Castle dependencies to the
bouncyCastle
feature variant in the Gradle build. Assigning these dependencies to a variant results in marking the libraries as optional dependencies in the published Maven configuration.This change builds on recent efforts to move away from and isolate use of the Bouncy Castle library throughout the project.
This could be considered a breaking change for consumers that rely on inclusion of Bouncy Castle as a transitive dependency and require features that Bouncy Castle provides.
Direct features include reading PEM key files encrypted using historical methods other than PKCS8, and reading PuTTY Key Version 3 files that require the Argon2 key derivation function. Indirect features that depend on the Bouncy Castle security provider include support for Ed25519 when running on Java 14 or earlier, and support for X25519 when running on Java 10 or earlier. All of these features will continue to work when Bouncy Castle dependencies are declared directly.
The alternative to this change is retaining the current dependency requirements, and requiring consumers to exclude the Bouncy Castle transitive dependencies.