provider registration

[Brad Wetmore]

On 2/28/2018 8:36 AM, Bernd wrote:
> Hello,
> 
> there was a thread on BouncyCastle's crypto-dev mailing list how to use 
> a custom JCA provider with Java 9+. Since there is no alternative for 
> the lib/ext extension mechanism this is a bit tricky (if you do want to 
> make the extension in the java.security file permanent).
> 
> There are multiple alternatives (adding to module path, to classpath, 
> using service loader or programmatic registration). Those are described 
> in the actual documentation.

Hopefully it's clear.  There was a lot of moving parts and sharp edges 
as JDK 9 came to a close.  Comments welcome of course.

> However expanding the java.security list

To be clear, when you say "expanding the java.security list", you mean 
adding an entry like:

     security.provider.14=MyProvider

> does not mention explicitely 
> that without the extension mechanism this produces a java home which 
> wont start without modifying the module path.

The JDK should still start, but it wouldn't be able to find MyProvider 
if it's not in either the class or module path.

> Not sure if there is actually a default way to storesuch a "security 
> provider module" 

Not aware of anything for JDK 9+, short of putting your provider into 
the module/classpath directory.  As you note, the extension 
mechanism/directory was removed in the JDK 9 (see JEP 220).

> without using for example jlink to build a new image 
> (or add the -mp argument).

Please note from the Provider documentation:

     You can link a provider in a custom runtime image with the jlink
     command as long as it doesn't have a Cipher, KeyAgreement, or MAC
     implementation.

Providers that don't have Cipher/KeyAgreement/MAC implementation can be 
jlinked.

However, providers providing Cipher/KeyAgreement/MAC implementations 
must be signed using a valid certificate to pass the export tests in 
implementations like Oracle JDK.  We only support signed modular jars 
(module-path) and signed jars (classpath).  There is not a signed JMOD 
feature, and thus jlink can't be used to create an image that will pass 
the export tests.

> Maybe this should be stated explicite?
> 
> "Starting with Java 9 there is no extension mechanism where you could 
> install the provider JAR permanently. Therefore expanding the 
> java.security leaves typically a incomplete java home and should be 
> avoided. Permanently installing an additional module could be done with 
> a custom jlink image."
> 
> (I havent tested if JLink works, BCProv is not yet modularized or 
> service loader enabled. Classpath and programmatic registration works fine).
> 
> Is that correct?

We could add some wording here to talk about the removal of the 
extension mechanism.

Hope that helps.

Brad