Switch to jdk18on bouncycastle jars #11201

harikrishna-patnala · 2025-07-15T11:08:56Z

Description

This PR fixes #10954

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Updated my environment with the newer jars and everything seems fine

How did you try to break this feature and the system with this change?

harikrishna-patnala · 2025-07-15T11:10:32Z

@blueorangutan package

blueorangutan · 2025-07-15T11:12:06Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

codecov · 2025-07-15T11:16:48Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 17.60%. Comparing base (286e406) to head (64d2dce).

Additional details and impacted files

@@            Coverage Diff            @@
##               4.22   #11201   +/-   ##
=========================================
  Coverage     17.60%   17.60%           
- Complexity    15624    15626    +2     
=========================================
  Files          5911     5911           
  Lines        530169   530169           
  Branches      64785    64785           
=========================================
+ Hits          93322    93344   +22     
+ Misses       426342   426319   -23     
- Partials      10505    10506    +1

Flag	Coverage Δ
uitests	`3.60% <ø> (ø)`
unittests	`18.67% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

blueorangutan · 2025-07-15T12:24:47Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 14192

DaanHoogland · 2025-07-15T13:37:45Z

@blueorangutan test matrix

blueorangutan · 2025-07-15T13:40:04Z

@DaanHoogland a [SL] Trillian-Jenkins matrix job (EL8 mgmt + EL8 KVM, Ubuntu22 mgmt + Ubuntu22 KVM, EL8 mgmt + VMware 7.0u3, EL9 mgmt + XCP-ng 8.2 ) has been kicked to run smoke tests

blueorangutan · 2025-07-15T14:39:06Z

[SF] Trillian Build Failed (tid-13786)

blueorangutan · 2025-07-15T14:39:32Z

[SF] Trillian Build Failed (tid-13784)

blueorangutan · 2025-07-15T14:44:47Z

[SF] Trillian Build Failed (tid-13785)

blueorangutan · 2025-07-15T14:51:31Z

[SF] Trillian Build Failed (tid-13783)

harikrishna-patnala · 2025-07-17T04:57:22Z

@blueorangutan test matrix

blueorangutan · 2025-07-17T04:58:04Z

@harikrishna-patnala a [SL] Trillian-Jenkins matrix job (EL8 mgmt + EL8 KVM, Ubuntu22 mgmt + Ubuntu22 KVM, EL8 mgmt + VMware 7.0u3, EL9 mgmt + XCP-ng 8.2 ) has been kicked to run smoke tests

blueorangutan · 2025-07-17T05:55:42Z

[SF] Trillian Build Failed (tid-13806)

blueorangutan · 2025-07-17T05:57:11Z

[SF] Trillian Build Failed (tid-13808)

blueorangutan · 2025-07-17T06:03:00Z

[SF] Trillian Build Failed (tid-13807)

blueorangutan · 2025-07-17T06:09:33Z

[SF] Trillian Build Failed (tid-13805)

harikrishna-patnala · 2025-07-18T09:08:43Z

@blueorangutan package

blueorangutan · 2025-07-18T09:10:06Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

harikrishna-patnala · 2025-07-18T09:19:39Z

@weizhouapache @DaanHoogland

The available versions for bouncy castle provider supporting jdk18 starts from 1.71 to 1.81 (https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on)

If we use 1.81 as the provider version

<cs.bcprov.version>1.81</cs.bcprov.version>

SystemVMs have trouble starting with the error

Caused by: java.lang.NoClassDefFoundError: Could not initialize class org.bouncycastle.operator.jcajce.OperatorHelper
        at org.bouncycastle.operator.jcajce.JcaContentSignerBuilder.<init>(Unknown Source)
        at org.apache.cloudstack.utils.security.CertUtils.generateV3Certificate(CertUtils.java:241)
        at org.apache.cloudstack.ca.provider.RootCAProvider.generateCertificate(RootCAProvider.java:152)

The last version that worked with our code is

<cs.bcprov.version>1.72</cs.bcprov.version>

At the moment I don't know the reason for "OperatorHelper" class not being found, so I adjusted the code to use 1.72 version. I'm not sure how the mentioned vulnerabilities effects us https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on/1.72

Please review and see if this is fine.

blueorangutan · 2025-07-18T10:01:53Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✖️ debian ✔️ suse15. SL-JID 14254

vishesh92

clgtm

blueorangutan · 2025-07-18T12:52:36Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✖️ debian ✔️ suse15. SL-JID 14256

weizhouapache · 2025-07-19T01:55:49Z

pom.xml

        <cs.axis2.version>1.6.4</cs.axis2.version>
        <cs.batik.version>1.14</cs.batik.version>
-        <cs.bcprov.version>1.70</cs.bcprov.version>
+        <cs.bcprov.version>1.72</cs.bcprov.version>


According to central mvn repo, 1.72 has 5 vulnerabilities, 1.81 is the latest

It seems here are some imcompatibility issue with 1.81, I think it can be fixed

@harikrishna-patnala check if the issues with 1.81 can be fixed or not

I've tried multiple ways to use 1.81 and rewriting code for getting X509Certificate but still facing the same issue. Can someone of you help me here @weizhouapache @sureshanaparti

borisstoyanov · 2026-01-29T06:14:50Z

@blueorangutan test

Copilot

Pull request overview

Updates Apache CloudStack’s BouncyCastle dependencies to the jdk18on artifact line and bumps the shared BouncyCastle version to address the security concern in #10954.

Changes:

Replace bcprov/bcpkix/bctls -jdk15on artifacts with -jdk18on across affected modules.
Bump ${cs.bcprov.version} from 1.70 to 1.82 and align dependencyManagement entries accordingly.
Update client build/shade/dependency-copy references and exclusions to match the new artifact IDs.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`pom.xml`	Bumps BouncyCastle version property and updates dependencyManagement to `-jdk18on` artifacts.
`utils/pom.xml`	Switches direct BouncyCastle dependencies to `bcprov/bcpkix/bctls-jdk18on`.
`services/console-proxy/rdpconsole/pom.xml`	Switches RDP console BouncyCastle dependencies to `bcprov/bctls-jdk18on`.
`plugins/integrations/kubernetes-service/pom.xml`	Updates Kubernetes plugin BouncyCastle dependencies to `bcprov/bctls-jdk18on`.
`client/pom.xml`	Updates Jetty plugin deps, dependency-plugin copies, and shade exclusions to `-jdk18on` artifacts.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

harikrishna-patnala · 2026-01-29T06:49:18Z

@blueorangutan package

blueorangutan · 2026-01-29T06:50:04Z

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

harikrishna-patnala · 2026-01-29T06:51:15Z

@borisstoyanov last time we had issues in deploying the system VMs, we need to check if that is still the case

blueorangutan · 2026-01-29T07:48:29Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16609

harikrishna-patnala · 2026-01-29T08:04:29Z

@blueorangutan test

blueorangutan · 2026-01-29T08:06:08Z

@harikrishna-patnala a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

harikrishna-patnala · 2026-01-29T09:07:00Z

This PR still has issues with systemVMs and host additions cc @DaanHoogland

blueorangutan · 2026-01-29T09:10:28Z

[SF] Trillian Build Failed (tid-15333)

boring-cyborg bot added component:build component:console-proxy component:kubernetes labels Jul 15, 2025

vishesh92 approved these changes Jul 18, 2025

View reviewed changes

harikrishna-patnala closed this Jul 18, 2025

harikrishna-patnala reopened this Jul 18, 2025

weizhouapache reviewed Jul 19, 2025

View reviewed changes

sureshanaparti requested a review from DaanHoogland July 20, 2025 15:47

sureshanaparti linked an issue Jul 25, 2025 that may be closed by this pull request

[Security] switch to jdk18on bouncycastle jars #10954

Open

borisstoyanov marked this pull request as ready for review January 29, 2026 06:14

Copilot AI review requested due to automatic review settings January 29, 2026 06:14

Copilot started reviewing on behalf of borisstoyanov January 29, 2026 06:15 View session

Copilot AI reviewed Jan 29, 2026

View reviewed changes

harikrishna-patnala force-pushed the switchBouncyCastleJars branch from 6138c02 to 207f819 Compare January 29, 2026 06:47

boring-cyborg bot added component:api component:backup component:management-server component:networking component:storage component:UI component:virtual-router distro:ubuntu Python Warning... Python code Ahead! labels Jan 29, 2026

harikrishna-patnala changed the base branch from main to 4.22 January 29, 2026 06:47

harikrishna-patnala and others added 3 commits January 29, 2026 12:18

switch to jdk18on bouncycastle jars

5369ecd

Version change

57fe448

Update bcprov to 1.82 in pom.xml

64d2dce

harikrishna-patnala force-pushed the switchBouncyCastleJars branch from 207f819 to 64d2dce Compare January 29, 2026 06:48

harikrishna-patnala added the status:needs-testing label Jan 29, 2026

harikrishna-patnala marked this pull request as draft January 29, 2026 09:06

Switch to jdk18on bouncycastle jars #11201

Are you sure you want to change the base?

Switch to jdk18on bouncycastle jars #11201

Conversation

harikrishna-patnala commented Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

harikrishna-patnala commented Jul 15, 2025

Uh oh!

blueorangutan commented Jul 15, 2025

Uh oh!

codecov bot commented Jul 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blueorangutan commented Jul 15, 2025

Uh oh!

DaanHoogland commented Jul 15, 2025

Uh oh!

blueorangutan commented Jul 15, 2025

Uh oh!

blueorangutan commented Jul 15, 2025

Uh oh!

blueorangutan commented Jul 15, 2025

Uh oh!

blueorangutan commented Jul 15, 2025

Uh oh!

blueorangutan commented Jul 15, 2025

Uh oh!

harikrishna-patnala commented Jul 17, 2025

Uh oh!

blueorangutan commented Jul 17, 2025

Uh oh!

blueorangutan commented Jul 17, 2025

Uh oh!

blueorangutan commented Jul 17, 2025

Uh oh!

blueorangutan commented Jul 17, 2025

Uh oh!

blueorangutan commented Jul 17, 2025

Uh oh!

harikrishna-patnala commented Jul 18, 2025

Uh oh!

blueorangutan commented Jul 18, 2025

Uh oh!

harikrishna-patnala commented Jul 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

blueorangutan commented Jul 18, 2025

Uh oh!

vishesh92 left a comment

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented Jul 18, 2025

Uh oh!

weizhouapache Jul 19, 2025

Choose a reason for hiding this comment

Uh oh!

sureshanaparti Jul 20, 2025

Choose a reason for hiding this comment

Uh oh!

harikrishna-patnala Jul 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

borisstoyanov commented Jan 29, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

harikrishna-patnala commented Jan 29, 2026

Uh oh!

harikrishna-patnala commented Jul 15, 2025 •

edited

Loading

codecov bot commented Jul 15, 2025 •

edited

Loading

harikrishna-patnala commented Jul 18, 2025 •

edited

Loading

harikrishna-patnala Jul 23, 2025 •

edited

Loading