This is an automated email from the ASF dual-hosted git repository.
jamesnetherton pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel-quarkus.git
The following commit(s) were added to refs/heads/main by this push:
new e84aac92194 Make the tests runnable on FIPS with Red Hat JDK 25 (JVM
mode)
e84aac92194 is described below
commit e84aac921943a6feb7182e66c67a4215de13ee6e
Author: Jiří Ondrušek <[email protected]>
AuthorDate: Mon Nov 9 08:34:32 2026 +0100
Make the tests runnable on FIPS with Red Hat JDK 25 (JVM mode)
* Fixes #9434. Make the tests runnable on FIPS with Red Hat JDK 25
- fips profile: on JDK 25+ limit jdk.tls.namedGroups to FIPS-approved
groups (NSS FIPS has no ML-KEM), also for the sql and jdbc tests; contributor
guide: FIPS build, incl. the manual MAVEN_OPTS named-groups step for JDK 25+.
- crypto: SunPKCS11-FIPS on JDK 25+, RSA instead of DSA, AES instead of
DES; under -Dbcfips a committed keystore (regenerate with generate-certs.sh)
replaces @TestCertificates.
- cxf-soap-grouped: exclude bc-fips in the fips profile until CXF 4.2.5
(CXF-9261).
* Address review feedback
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---------
Co-authored-by: jiriOndrusek-agent <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
---
.../ROOT/pages/contributor-guide/index.adoc | 23 +++++
integration-test-groups/jdbc/db2/pom.xml | 2 +-
integration-test-groups/jdbc/h2/pom.xml | 2 +-
integration-test-groups/jdbc/mariadb/pom.xml | 2 +-
integration-test-groups/jdbc/mssql/pom.xml | 2 +-
integration-test-groups/jdbc/mysql/pom.xml | 2 +-
integration-test-groups/jdbc/oracle/pom.xml | 2 +-
integration-test-groups/jdbc/postgresql/pom.xml | 2 +-
.../TestCertificateGenerationExtension.java | 6 ++
integration-tests/crypto/README.adoc | 4 +-
integration-tests/crypto/generate-certs.sh | 60 +++++++++++++
integration-tests/crypto/pom.xml | 63 ++++++++++++-
.../component/crypto/it/CryptoResource.java | 18 ++--
.../quarkus/component/crypto/it/CryptoRoutes.java | 15 ++--
.../src/main/resources/application.properties | 6 +-
.../crypto/src/main/resources/crypto-keystore.p12 | Bin 0 -> 2704 bytes
.../crypto/src/main/resources/crypto.jks | Bin 3734 -> 0 bytes
.../quarkus/component/crypto/it/CryptoTest.java | 5 ++
integration-tests/cxf-soap-grouped/pom.xml | 97 +++++++++++++++++++++
integration-tests/milo/pom.xml | 3 +-
integration-tests/sql/pom.xml | 2 +-
pom.xml | 49 +++++++++++
22 files changed, 340 insertions(+), 25 deletions(-)
diff --git a/docs/modules/ROOT/pages/contributor-guide/index.adoc
b/docs/modules/ROOT/pages/contributor-guide/index.adoc
index e5639236b67..07a736f3939 100644
--- a/docs/modules/ROOT/pages/contributor-guide/index.adoc
+++ b/docs/modules/ROOT/pages/contributor-guide/index.adoc
@@ -54,6 +54,29 @@ TIP: Extensions that depend on Java AWT are not yet
supported for native image g
TIP: To run a specific integration test, you can use the `-Dtest` property.
For example: `mvn clean test -Dtest=MyTest`. To run tests in a specific module,
use the `-pl` (project list) flag: `mvn clean test -pl
integration-tests/my-module`.
+=== FIPS
+
+A build on a FIPS-enabled machine:
+
+[source,shell]
+----
+mvn clean install -Dfips
+----
+
+With JDK 25+, remove the hybrid `X25519MLKEM768` group (not supported by the
SunPKCS11 FIPS provider) from the TLS named groups of Maven itself:
+
+[source,shell]
+----
+export MAVEN_OPTS="$MAVEN_OPTS
-Djdk.tls.namedGroups=secp256r1,secp384r1,secp521r1,ffdhe2048,ffdhe3072,ffdhe4096,ffdhe6144,ffdhe8192"
+----
+
+The WS-Security tests need `-Dfips.enabled=true`. Use it only for the CXF
grouped module, other CXF modules fail to build with it:
+
+[source,shell]
+----
+mvn clean install -Dfips -Dfips.enabled=true -f
integration-tests/cxf-soap-grouped
+----
+
== What's next?
* xref:create-new-extension.adoc[Create new extension].
diff --git a/integration-test-groups/jdbc/db2/pom.xml
b/integration-test-groups/jdbc/db2/pom.xml
index 1d564209374..ca6b6d5fb56 100644
--- a/integration-test-groups/jdbc/db2/pom.xml
+++ b/integration-test-groups/jdbc/db2/pom.xml
@@ -162,7 +162,7 @@
</executions>
<configuration>
<systemPropertyVariables>
-
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}</quarkus.test.arg-line>
+
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}
${fips.test.arg-line}</quarkus.test.arg-line>
</systemPropertyVariables>
</configuration>
</plugin>
diff --git a/integration-test-groups/jdbc/h2/pom.xml
b/integration-test-groups/jdbc/h2/pom.xml
index 82464610aa3..b29fbc200d9 100644
--- a/integration-test-groups/jdbc/h2/pom.xml
+++ b/integration-test-groups/jdbc/h2/pom.xml
@@ -158,7 +158,7 @@
</executions>
<configuration>
<systemPropertyVariables>
-
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}</quarkus.test.arg-line>
+
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}
${fips.test.arg-line}</quarkus.test.arg-line>
</systemPropertyVariables>
</configuration>
</plugin>
diff --git a/integration-test-groups/jdbc/mariadb/pom.xml
b/integration-test-groups/jdbc/mariadb/pom.xml
index c261e4373f2..0d806946ba4 100644
--- a/integration-test-groups/jdbc/mariadb/pom.xml
+++ b/integration-test-groups/jdbc/mariadb/pom.xml
@@ -158,7 +158,7 @@
</executions>
<configuration>
<systemPropertyVariables>
-
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}</quarkus.test.arg-line>
+
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}
${fips.test.arg-line}</quarkus.test.arg-line>
</systemPropertyVariables>
</configuration>
</plugin>
diff --git a/integration-test-groups/jdbc/mssql/pom.xml
b/integration-test-groups/jdbc/mssql/pom.xml
index e898a77d1b3..5b8fb79d825 100644
--- a/integration-test-groups/jdbc/mssql/pom.xml
+++ b/integration-test-groups/jdbc/mssql/pom.xml
@@ -162,7 +162,7 @@
</executions>
<configuration>
<systemPropertyVariables>
-
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}</quarkus.test.arg-line>
+
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}
${fips.test.arg-line}</quarkus.test.arg-line>
</systemPropertyVariables>
</configuration>
</plugin>
diff --git a/integration-test-groups/jdbc/mysql/pom.xml
b/integration-test-groups/jdbc/mysql/pom.xml
index 11bc464b60f..c37d72907a1 100644
--- a/integration-test-groups/jdbc/mysql/pom.xml
+++ b/integration-test-groups/jdbc/mysql/pom.xml
@@ -163,7 +163,7 @@
</executions>
<configuration>
<systemPropertyVariables>
-
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}</quarkus.test.arg-line>
+
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}
${fips.test.arg-line}</quarkus.test.arg-line>
</systemPropertyVariables>
</configuration>
</plugin>
diff --git a/integration-test-groups/jdbc/oracle/pom.xml
b/integration-test-groups/jdbc/oracle/pom.xml
index 48698501ef8..0551d821ec1 100644
--- a/integration-test-groups/jdbc/oracle/pom.xml
+++ b/integration-test-groups/jdbc/oracle/pom.xml
@@ -163,7 +163,7 @@
</executions>
<configuration>
<systemPropertyVariables>
-
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}</quarkus.test.arg-line>
+
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}
${fips.test.arg-line}</quarkus.test.arg-line>
</systemPropertyVariables>
</configuration>
</plugin>
diff --git a/integration-test-groups/jdbc/postgresql/pom.xml
b/integration-test-groups/jdbc/postgresql/pom.xml
index 421f1ff4d05..dcd1716ea6f 100644
--- a/integration-test-groups/jdbc/postgresql/pom.xml
+++ b/integration-test-groups/jdbc/postgresql/pom.xml
@@ -158,7 +158,7 @@
</executions>
<configuration>
<systemPropertyVariables>
-
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}</quarkus.test.arg-line>
+
<quarkus.test.arg-line>-Dcq.jdbcKind=${cq.jdbcKind}
${fips.test.arg-line}</quarkus.test.arg-line>
</systemPropertyVariables>
</configuration>
</plugin>
diff --git
a/integration-tests-support/certificate-generator/src/main/java/org/apache/camel/quarkus/test/support/certificate/TestCertificateGenerationExtension.java
b/integration-tests-support/certificate-generator/src/main/java/org/apache/camel/quarkus/test/support/certificate/TestCertificateGenerationExtension.java
index 25e998558a3..144ffeea2a6 100644
---
a/integration-tests-support/certificate-generator/src/main/java/org/apache/camel/quarkus/test/support/certificate/TestCertificateGenerationExtension.java
+++
b/integration-tests-support/certificate-generator/src/main/java/org/apache/camel/quarkus/test/support/certificate/TestCertificateGenerationExtension.java
@@ -45,6 +45,7 @@ import org.testcontainers.DockerClientFactory;
*/
public class TestCertificateGenerationExtension implements BeforeAllCallback {
private static final Logger LOGGER =
Logger.getLogger(TestCertificateGenerationExtension.class);
+ private static final String SKIP_PROPERTY = "cq.test.certificates.skip";
public static TestCertificateGenerationExtension
getInstance(ExtensionContext extensionContext) {
return extensionContext.getStore(ExtensionContext.Namespace.GLOBAL)
@@ -59,6 +60,11 @@ public class TestCertificateGenerationExtension implements
BeforeAllCallback {
if (maybe.isEmpty()) {
return;
}
+ // the certificates are provided otherwise, e.g. where the non-FIPS
BouncyCastle of the generator cannot be used
+ if (Boolean.getBoolean(SKIP_PROPERTY)) {
+ LOGGER.infof("Certificate generation skipped, %s is true",
SKIP_PROPERTY);
+ return;
+ }
var annotation = maybe.get();
//cn and alternativeSubjectName might be different (to reflect docker
host)
diff --git a/integration-tests/crypto/README.adoc
b/integration-tests/crypto/README.adoc
index 70c1f907361..99ae7dafbe8 100644
--- a/integration-tests/crypto/README.adoc
+++ b/integration-tests/crypto/README.adoc
@@ -3,8 +3,8 @@
Please utilize the fips profile when executing tests within a FIPS-enabled
environment.
There are two profiles:
-* Use `bcfips` profile to employ the BouncyCastle-FIPS security provider.
-* Use `fips` profile to employ the SunPKCS11-NSS-FIPS security provider.
+* Use `bcfips` profile to employ the BouncyCastle-FIPS security provider. It
uses the committed `src/main/resources/crypto-keystore.p12` instead of
`@TestCertificates`. To regenerate it, run `./generate-certs.sh` (needs
`openssl`) from this directory.
+* Use `fips` profile to employ the SunPKCS11-NSS-FIPS security provider
(SunPKCS11-FIPS on JDK 25+).
Example of usage:
diff --git a/integration-tests/crypto/generate-certs.sh
b/integration-tests/crypto/generate-certs.sh
new file mode 100755
index 00000000000..bd2ec9d180e
--- /dev/null
+++ b/integration-tests/crypto/generate-certs.sh
@@ -0,0 +1,60 @@
+#!/bin/bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+# Generates the keystore of CryptoResource for the bcfips profile, where
@TestCertificates cannot be used,
+# as its certificate generator needs the non-FIPS BouncyCastle. Not run by the
build, run it from this directory
+# to regenerate the committed src/main/resources/crypto-keystore.p12
+
+set -e
+set -x
+
+keySize=2048
+days=10000
+alias="crypto"
+password="crypto-keystore-password"
+encryptionAlgo="aes-256-cbc"
+
+workDir="target/openssl-work"
+destinationDir="src/main/resources"
+
+# see https://stackoverflow.com/a/54924640
+export MSYS_NO_PATHCONV=1
+
+if [[ -n "${JAVA_HOME}" ]] ; then
+ keytool="$JAVA_HOME/bin/keytool"
+elif ! [[ -x "$(command -v keytool)" ]] ; then
+ echo 'Error: Either add keytool to PATH or set JAVA_HOME' >&2
+ exit 1
+else
+ keytool="keytool"
+fi
+
+if ! [[ -x "$(command -v openssl)" ]] ; then
+ echo 'Error: openssl is not installed.' >&2
+ exit 1
+fi
+
+mkdir -p "$workDir"
+mkdir -p "$destinationDir"
+
+openssl genrsa -out "$workDir/$alias.key" $keySize
+openssl req -x509 -new -subj "/O=apache.org/OU=eng (NOT FOR
PRODUCTION)/CN=$alias" -key "$workDir/$alias.key" -days $days -out
"$workDir/$alias.crt"
+openssl pkcs12 -export -in "$workDir/$alias.crt" -inkey "$workDir/$alias.key"
-name "$alias" -out "$destinationDir/$alias-keystore.p12" -passout
pass:"$password" -keypbe "$encryptionAlgo" -certpbe "$encryptionAlgo"
+
+# Fail early if the JDK cannot read the keystore
+"$keytool" -list -keystore "$destinationDir/$alias-keystore.p12" -storetype
PKCS12 -storepass "$password"
diff --git a/integration-tests/crypto/pom.xml b/integration-tests/crypto/pom.xml
index 8d57cd27104..a2b597c4cc9 100644
--- a/integration-tests/crypto/pom.xml
+++ b/integration-tests/crypto/pom.xml
@@ -30,6 +30,11 @@
<name>Camel Quarkus :: Integration Tests :: Crypto (JCE)</name>
<description>Integration tests for Camel Quarkus Crypto (JCE)
extension</description>
+ <properties>
+ <!-- Generated by @TestCertificates in CryptoTest. The bcfips profile
uses the committed one of generate-certs.sh -->
+
<cq-crypto-keystore>file:target/certs/crypto-keystore.p12</cq-crypto-keystore>
+ </properties>
+
<build>
<resources>
<resource>
@@ -41,10 +46,10 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-resources-plugin</artifactId>
- <!-- Required to do not alter crypto.jks -->
+ <!-- Required to do not alter crypto-keystore.p12 -->
<configuration>
<nonFilteredFileExtensions>
-
<nonFilteredFileExtension>jks</nonFilteredFileExtension>
+
<nonFilteredFileExtension>p12</nonFilteredFileExtension>
</nonFilteredFileExtensions>
</configuration>
</plugin>
@@ -86,6 +91,11 @@
<artifactId>quarkus-junit-internal</artifactId>
<scope>test</scope>
</dependency>
+ <dependency>
+ <groupId>org.apache.camel.quarkus</groupId>
+
<artifactId>camel-quarkus-integration-tests-support-certificate-generator</artifactId>
+ <scope>test</scope>
+ </dependency>
</dependencies>
<profiles>
@@ -98,6 +108,7 @@
</activation>
<properties>
<cq-security-provider>quarkus.security.security-providers=BCFIPS</cq-security-provider>
+
<cq-crypto-keystore>classpath:crypto-keystore.p12</cq-crypto-keystore>
</properties>
<dependencies>
<dependency>
@@ -108,7 +119,42 @@
<groupId>io.quarkus</groupId>
<artifactId>quarkus-security</artifactId>
</dependency>
+ <!-- The non-FIPS BouncyCastle of the certificate generator
clashes with bc-fips.
+ The keystore of generate-certs.sh is used instead of
@TestCertificates -->
+ <dependency>
+ <groupId>org.apache.camel.quarkus</groupId>
+
<artifactId>camel-quarkus-integration-tests-support-certificate-generator</artifactId>
+ <scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>*</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
</dependencies>
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-surefire-plugin</artifactId>
+ <configuration>
+ <systemPropertyVariables>
+
<cq.test.certificates.skip>true</cq.test.certificates.skip>
+ </systemPropertyVariables>
+ </configuration>
+ </plugin>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-failsafe-plugin</artifactId>
+ <configuration>
+ <systemPropertyVariables>
+
<cq.test.certificates.skip>true</cq.test.certificates.skip>
+ </systemPropertyVariables>
+ </configuration>
+ </plugin>
+ </plugins>
+ </build>
</profile>
<profile>
<id>fips</id>
@@ -127,6 +173,19 @@
</dependency>
</dependencies>
</profile>
+ <profile>
+ <!-- Red Hat JDK 25+ names the NSS FIPS provider SunPKCS11-FIPS -->
+ <id>fips-jdk25</id>
+ <activation>
+ <jdk>[25,)</jdk>
+ <property>
+ <name>fips</name>
+ </property>
+ </activation>
+ <properties>
+
<cq-security-provider>quarkus.security.security-providers=SunPKCS11-FIPS</cq-security-provider>
+ </properties>
+ </profile>
<profile>
<id>native</id>
<activation>
diff --git
a/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoResource.java
b/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoResource.java
index a23dda4087d..2556d622136 100644
---
a/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoResource.java
+++
b/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoResource.java
@@ -32,23 +32,31 @@ import jakarta.ws.rs.Produces;
import jakarta.ws.rs.QueryParam;
import jakarta.ws.rs.core.MediaType;
import jakarta.ws.rs.core.Response;
+import org.apache.camel.CamelContext;
import org.apache.camel.Exchange;
import org.apache.camel.Message;
import org.apache.camel.Processor;
import org.apache.camel.ProducerTemplate;
import org.apache.camel.component.crypto.DigitalSignatureConstants;
+import org.apache.camel.support.ResourceHelper;
+import org.eclipse.microprofile.config.inject.ConfigProperty;
@Path("/crypto")
public class CryptoResource {
public static final String MESSAGE = "Hello Camel Quarkus Crypto";
- private static final String ALIAS = "bob";
- private static final String KEYSTORE = "crypto.jks";
- private static final String KEYSTORE_PASSWORD = "letmein";
+ private static final String ALIAS = "crypto";
+ static final String KEYSTORE_PASSWORD = "crypto-keystore-password";
@Inject
ProducerTemplate producerTemplate;
+ @Inject
+ CamelContext camelContext;
+
+ @ConfigProperty(name = "crypto.keystore")
+ String keystoreUri;
+
@Path("/signature/sign")
@POST
public byte[] sign(@QueryParam("raw") boolean raw) {
@@ -100,8 +108,8 @@ public class CryptoResource {
@jakarta.enterprise.inject.Produces
public KeyStore keyStore() throws Exception {
- KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
- try (InputStream in = getClass().getResourceAsStream("/" + KEYSTORE)) {
+ KeyStore keystore = KeyStore.getInstance("PKCS12");
+ try (InputStream in =
ResourceHelper.resolveMandatoryResourceAsInputStream(camelContext,
keystoreUri)) {
keystore.load(in, KEYSTORE_PASSWORD.toCharArray());
}
return keystore;
diff --git
a/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoRoutes.java
b/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoRoutes.java
index 56461cb93f5..54382ea1902 100644
---
a/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoRoutes.java
+++
b/integration-tests/crypto/src/main/java/org/apache/camel/quarkus/component/crypto/it/CryptoRoutes.java
@@ -19,6 +19,7 @@ package org.apache.camel.quarkus.component.crypto.it;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
import javax.crypto.KeyGenerator;
@@ -32,7 +33,7 @@ public class CryptoRoutes extends RouteBuilder {
@Override
public void configure() throws Exception {
String provider = ConfigProvider.getConfig()
- .getOptionalValue("quarkus.security.security-providers",
String.class).orElse("SUN");
+ .getOptionalValue("quarkus.security.security-providers",
String.class).orElse("SunRsaSign");
// Crypto component using raw keys
final KeyPair keys =
KeyPairGenerator.getInstance("RSA").generateKeyPair();
from("direct:sign-raw")
@@ -45,11 +46,11 @@ public class CryptoRoutes extends RouteBuilder {
// Crypto component using keys from a keystore
from("direct:sign")
-
.toF("crypto:sign:basic?privateKey=#myPrivateKey&algorithm=SHA1withDSA&provider=%s&secureRandom=#customSecureRandom",
+
.toF("crypto:sign:basic?privateKey=#myPrivateKey&algorithm=SHA256withRSA&provider=%s&secureRandom=#customSecureRandom",
provider);
from("direct:verify")
-
.toF("crypto:verify:basic?publicKey=#myPublicKey&algorithm=SHA1withDSA&provider=%s&secureRandom=#customSecureRandom",
+
.toF("crypto:verify:basic?publicKey=#myPublicKey&algorithm=SHA256withRSA&provider=%s&secureRandom=#customSecureRandom",
provider);
// Crypto data format
@@ -62,8 +63,12 @@ public class CryptoRoutes extends RouteBuilder {
}
private CryptoDataFormat getCryptoDataFormat() throws
NoSuchAlgorithmException {
- KeyGenerator generator = KeyGenerator.getInstance("DES");
- CryptoDataFormat cdf = new CryptoDataFormat("DES",
generator.generateKey());
+ KeyGenerator generator = KeyGenerator.getInstance("AES");
+ CryptoDataFormat cdf = new CryptoDataFormat("AES/CBC/PKCS5Padding",
generator.generateKey());
+ byte[] iv = new byte[16];
+ new SecureRandom().nextBytes(iv);
+ cdf.setInitVector(iv);
+ cdf.setShouldInlineInitializationVector(true);
//workaround for SunPKCS11-NSS-FIPS
cdf.setShouldAppendHMAC(false);
return cdf;
diff --git a/integration-tests/crypto/src/main/resources/application.properties
b/integration-tests/crypto/src/main/resources/application.properties
index 6df55e4420f..e0fec85f62d 100644
--- a/integration-tests/crypto/src/main/resources/application.properties
+++ b/integration-tests/crypto/src/main/resources/application.properties
@@ -14,7 +14,9 @@
## See the License for the specific language governing permissions and
## limitations under the License.
## ---------------------------------------------------------------------------
-quarkus.native.resources.includes=*.jks
-#profile adds SunPKCS11-NSS-FIPS or BCFIPS provider
+#profile adds SunPKCS11-NSS-FIPS (SunPKCS11-FIPS on JDK 25+) or BCFIPS provider
${cq-security-provider}
+
+crypto.keystore=${cq-crypto-keystore}
+quarkus.native.resources.includes=crypto-keystore.p12
diff --git a/integration-tests/crypto/src/main/resources/crypto-keystore.p12
b/integration-tests/crypto/src/main/resources/crypto-keystore.p12
new file mode 100644
index 00000000000..2522ae1cb8e
Binary files /dev/null and
b/integration-tests/crypto/src/main/resources/crypto-keystore.p12 differ
diff --git a/integration-tests/crypto/src/main/resources/crypto.jks
b/integration-tests/crypto/src/main/resources/crypto.jks
deleted file mode 100644
index 7db483e3094..00000000000
Binary files a/integration-tests/crypto/src/main/resources/crypto.jks and
/dev/null differ
diff --git
a/integration-tests/crypto/src/test/java/org/apache/camel/quarkus/component/crypto/it/CryptoTest.java
b/integration-tests/crypto/src/test/java/org/apache/camel/quarkus/component/crypto/it/CryptoTest.java
index 8f2df1d35b9..211d7c231d7 100644
---
a/integration-tests/crypto/src/test/java/org/apache/camel/quarkus/component/crypto/it/CryptoTest.java
+++
b/integration-tests/crypto/src/test/java/org/apache/camel/quarkus/component/crypto/it/CryptoTest.java
@@ -20,6 +20,9 @@ import java.nio.charset.StandardCharsets;
import io.quarkus.test.junit.QuarkusTest;
import io.restassured.RestAssured;
+import io.smallrye.certs.Format;
+import io.smallrye.certs.junit5.Certificate;
+import org.apache.camel.quarkus.test.support.certificate.TestCertificates;
import org.apache.commons.codec.binary.Base64;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.params.ParameterizedTest;
@@ -30,6 +33,8 @@ import static org.hamcrest.Matchers.is;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertTrue;
+@TestCertificates(certificates = {
+ @Certificate(name = "crypto", formats = Format.PKCS12, password =
CryptoResource.KEYSTORE_PASSWORD) })
@QuarkusTest
public class CryptoTest {
diff --git a/integration-tests/cxf-soap-grouped/pom.xml
b/integration-tests/cxf-soap-grouped/pom.xml
index 2067aef3491..cb14741de02 100644
--- a/integration-tests/cxf-soap-grouped/pom.xml
+++ b/integration-tests/cxf-soap-grouped/pom.xml
@@ -37,6 +37,7 @@
</properties>
<!-- Regenerate the dependencies via `mvn process-resources -Pformat -N`
from the source tree root directory -->
+ <!-- A new CXF dependency here needs a bc-fips exclusion in the fips
profile below too -->
<dependencies>
<dependency>
<groupId>io.quarkiverse.cxf</groupId>
@@ -188,6 +189,102 @@
</build>
<profiles>
+ <profile>
+ <!-- mvn test -Dfips -Dfips.enabled=true
+ With -Dfips.enabled=true (WSS4J needs it to detect FIPS
mode), the fips profile of cxf-parent adds
+ org.bouncycastle:bc-fips to all CXF artifacts. It clashes
with quarkus-cxf-bc-stub and the build fails.
+ Not needed with CXF 4.2.5+, which moves bc-fips to a separate
profile (CXF-9261).
+ Keep the exclusions of the dependencies above, a profile
dependency replaces them.
+ TODO: remove this profile once CXF 4.2.5+ is in
https://issues.apache.org/jira/browse/CXF-9261 -->
+ <id>fips</id>
+ <activation>
+ <property>
+ <name>fips</name>
+ </property>
+ </activation>
+ <dependencies>
+ <dependency>
+ <groupId>io.quarkiverse.cxf</groupId>
+ <artifactId>quarkus-cxf-rt-features-metrics</artifactId>
+ <exclusions>
+ <exclusion>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bc-fips</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>io.quarkiverse.cxf</groupId>
+ <artifactId>quarkus-cxf-rt-ws-security</artifactId>
+ <exclusions>
+ <exclusion>
+ <groupId>com.google.code.findbugs</groupId>
+ <artifactId>jsr305</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bc-fips</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>io.quarkiverse.cxf</groupId>
+ <artifactId>quarkus-cxf-services-sts</artifactId>
+ <exclusions>
+ <exclusion>
+ <groupId>com.google.code.findbugs</groupId>
+ <artifactId>jsr305</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bc-fips</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>io.quarkiverse.cxf</groupId>
+ <artifactId>quarkus-cxf-xjc-plugins</artifactId>
+ <exclusions>
+ <exclusion>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bc-fips</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>org.apache.camel.quarkus</groupId>
+ <artifactId>camel-quarkus-cxf-soap</artifactId>
+ <exclusions>
+ <exclusion>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bc-fips</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>io.quarkiverse.cxf</groupId>
+ <artifactId>quarkus-cxf-test-util</artifactId>
+ <scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bc-fips</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>io.quarkiverse.cxf</groupId>
+ <artifactId>quarkus-cxf-test-util-internal</artifactId>
+ <scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <groupId>org.bouncycastle</groupId>
+ <artifactId>bc-fips</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ </dependencies>
+ </profile>
<profile>
<id>native</id>
<activation>
diff --git a/integration-tests/milo/pom.xml b/integration-tests/milo/pom.xml
index 6c1520db4b4..136711a702b 100644
--- a/integration-tests/milo/pom.xml
+++ b/integration-tests/milo/pom.xml
@@ -82,7 +82,8 @@
<properties>
<quarkus.native.enabled>true</quarkus.native.enabled>
<!-- TODO: https://github.com/apache/camel-quarkus/issues/9001
-->
-
<quarkus.native.additional-build-args-append>-H:-AOTSingleCallsiteInline</quarkus.native.additional-build-args-append>
+ <!-- Not -append, which the fips-jdk25 profile of the root pom
sets -->
+
<quarkus.native.additional-build-args>-H:-AOTSingleCallsiteInline</quarkus.native.additional-build-args>
</properties>
<build>
<plugins>
diff --git a/integration-tests/sql/pom.xml b/integration-tests/sql/pom.xml
index 4d79fc0d2b4..94c469f75c2 100644
--- a/integration-tests/sql/pom.xml
+++ b/integration-tests/sql/pom.xml
@@ -114,7 +114,7 @@
</executions>
<configuration>
<systemPropertyVariables>
-
<quarkus.test.arg-line>-Dcq.sqlJdbcKind=${cq.sqlJdbcKind}</quarkus.test.arg-line>
+
<quarkus.test.arg-line>-Dcq.sqlJdbcKind=${cq.sqlJdbcKind}
${fips.test.arg-line}</quarkus.test.arg-line>
</systemPropertyVariables>
</configuration>
</plugin>
diff --git a/pom.xml b/pom.xml
index e260db11043..794108eec6c 100644
--- a/pom.xml
+++ b/pom.xml
@@ -318,6 +318,9 @@
<!-- allow findbugs dependency in the enforcer -->
<allow-findbugs>false</allow-findbugs>
+
+ <!-- Set by the fips-jdk25 profile. Modules setting their own
quarkus.test.arg-line must append it -->
+ <fips.test.arg-line />
</properties>
<!-- Core modules -->
@@ -1755,6 +1758,52 @@
<sql-server.container.image>${sql-server.container.image.fips}</sql-server.container.image>
</properties>
</profile>
+ <profile>
+ <!-- NSS FIPS has no ML-KEM, so the TLS handshake fails if the
hybrid X25519MLKEM768 group is offered -->
+ <id>fips-jdk25</id>
+ <!-- JDK 25+ only: older JDKs don't offer X25519MLKEM768, their
FIPS default is already the list below -->
+ <activation>
+ <jdk>[25,)</jdk>
+ <property>
+ <name>fips</name>
+ </property>
+ </activation>
+ <properties>
+ <!-- The groups a Red Hat JDK 25 enables on a FIPS machine,
without the hybrid ML-KEM ones, as printed there by
+ echo 'String.join(",",
javax.net.ssl.SSLContext.getDefault().getDefaultSSLParameters().getNamedGroups())'
| jshell -q -->
+
<fips.tls.named-groups>secp256r1,secp384r1,secp521r1,ffdhe2048,ffdhe3072,ffdhe4096,ffdhe6144,ffdhe8192</fips.tls.named-groups>
+
<fips.test.arg-line>-Djdk.tls.namedGroups=${fips.tls.named-groups}</fips.test.arg-line>
+ <!-- The native image builder initializes JSSE classes reading
jdk.tls.namedGroups, the same groups with escaped commas -->
+
<quarkus.native.additional-build-args-append>-J-Djdk.tls.namedGroups=secp256r1\,secp384r1\,secp521r1\,ffdhe2048\,ffdhe3072\,ffdhe4096\,ffdhe6144\,ffdhe8192</quarkus.native.additional-build-args-append>
+ </properties>
+ <build>
+ <pluginManagement>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-surefire-plugin</artifactId>
+ <configuration>
+ <systemPropertyVariables>
+
<jdk.tls.namedGroups>${fips.tls.named-groups}</jdk.tls.namedGroups>
+ </systemPropertyVariables>
+ </configuration>
+ </plugin>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-failsafe-plugin</artifactId>
+ <configuration>
+ <systemPropertyVariables>
+ <!-- the test JVM is a TLS client too,
e.g. RestAssured over HTTPS -->
+
<jdk.tls.namedGroups>${fips.tls.named-groups}</jdk.tls.namedGroups>
+ <!-- passed to the application under test,
e.g. the native binary -->
+
<quarkus.test.arg-line>${fips.test.arg-line}</quarkus.test.arg-line>
+ </systemPropertyVariables>
+ </configuration>
+ </plugin>
+ </plugins>
+ </pluginManagement>
+ </build>
+ </profile>
</profiles>
</project>
