[jdk11u-dev] RFR: 8305972: Update XML Security for Java to 3.0.2

Goetz Lindenmaier goetz at openjdk.org
Fri Jan 12 07:36:00 UTC 2024


This backport is based on https://github.com/openjdk/jdk17u-dev/pull/2116 , the minimal version.
It contains the full EdDSA functionality and only removes the Strings that are explicitly not documented for backport in the CSRs.

I needed the following adaptions you find in seperate commits:

**Resolves**:

The implementation in the jdk patched clean. 
There were some conflicts in the tests:

test/jdk/TEST.groups
  trivial resolve due to context.

test/jdk/javax/xml/crypto/dsig/GenerationTests.java
  trivial resolve due to context.  8241306 is missing in the context.

test/jdk/javax/xml/crypto/dsig/SecureValidation.java
 This file is not in 11.
  It came with "8241306: Add SignatureMethodParameterSpec subclass
  for RSASSA-PSS params" which was not backported. Changes omitted.

test/lib/jdk/test/lib/security/XMLUtils.java
  One chunk does not apply because the removed code differs.
  In 17, a switch statement is used that was adapted to Java 11.
  Moved the comment and exception thrown in 11 to the new place.


**Make it compile and make the tests work**:

The changes to the libraries compile out of the box.

The tests needed several adaptions. I did not remove the
bad code yet, but just commented it out to highlight the 
differences better for now.

test/jdk/javax/xml/crypto/dsig/Basic.java
  I had to remove test cases because
    8241305: Add SignatureMethodParameterSpec subclass for RSASSA-PSS params
    8166597: Crypto support for the EdDSA Signature Algorithm
  are not in 11.

test/jdk/javax/xml/crypto/dsig/GenerationTests.java
  To make it compile, I
  replaced HexFormat.of().parseHex() by jdk.test.lib.Utils.toByteArray().
  Further, I commented a row of test coding that does not compile.
  "8166597: Crypto support for the EdDSA Signature Algorithm" would
  be needed to get these test cases working.
  This effectively removes the test cases for the new functionality.

test/jdk/javax/xml/crypto/dsig/HereFunction.java
  A simple tweak to enable testing of sha1 is not needed in 11.
  In 11, sha1 is still available per default as
  "8259709: Disable SHA-1 XML Signatures" was not backported.

test/lib/jdk/test/lib/security/XMLUtils.java
  More complex resolve because a previous backport was already adapted to 11.
  The code in 17 uses incompatible switch and instanceof
  in several places.
  It also needed adaptions because it does not compile as
    8166597: Crypto support for the EdDSA Signature Algorithm
  is not in 11.

-------------

Commit messages:
 - Merge branch 'openjdk:master' into goetz_backport_8305972-minimal
 - Fix tests, they now all pass
 - Resolve chunks that did not apply.
 - Backport 8309572 17u minimal change -- clean parts

Changes: https://git.openjdk.org/jdk11u-dev/pull/2455/files
 Webrev: https://webrevs.openjdk.org/?repo=jdk11u-dev&pr=2455&range=00
  Issue: https://bugs.openjdk.org/browse/JDK-8305972
  Stats: 1175 lines in 37 files changed: 917 ins; 144 del; 114 mod
  Patch: https://git.openjdk.org/jdk11u-dev/pull/2455.diff
  Fetch: git fetch https://git.openjdk.org/jdk11u-dev.git pull/2455/head:pull/2455

PR: https://git.openjdk.org/jdk11u-dev/pull/2455


More information about the jdk-updates-dev mailing list