(sling-org-apache-sling-commons-crypto) branch master updated: SLING-13318 Deprecate Jasypt implementation

[kwin]

This is an automated email from the ASF dual-hosted git repository.

kwin pushed a commit to branch master
in repository 
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-commons-crypto.git


The following commit(s) were added to refs/heads/master by this push:
     new 476e4a1  SLING-13318 Deprecate Jasypt implementation
476e4a1 is described below

commit 476e4a18a76cd80163ff48da82f47ae33e319917
Author: Konrad Windszus <k...@apache.org>
AuthorDate: Fri Aug 21 10:23:22 2026 +0200

    SLING-13318 Deprecate Jasypt implementation
---
 README.md                                                      | 10 +++++++++-
 .../jasypt/internal/JasyptStandardPbeStringCryptoService.java  |  1 +
 .../sling/commons/crypto/jasypt/internal/package-info.java     |  2 ++
 .../org/apache/sling/commons/crypto/jasypt/package-info.java   |  2 ++
 4 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index d9f0ee8..3477723 100644
--- a/README.md
+++ b/README.md
@@ -6,6 +6,14 @@
 
 This module is part of the [Apache Sling](https://sling.apache.org) project.
 
-This module contains a simple crypto API and an extensible but optional 
implementation based on [Jasypt](https://github.com/jasypt/jasypt) as well as a 
plugin for Felix Web Console to encrypt messages.
+This module contains a simple crypto API and two implementations:
+
+- A [Java Cryptographic 
Architecture(JCA)](https://docs.oracle.com/en/java/javase/11/security/java-cryptography-architecture-jca-reference-guide.html)
 based one
+- A **deprecated** one based on the no longer maintained library 
[Jasypt](https://github.com/jasypt/jasypt). **It is strongly recommended to 
migrate to the JCA one with a strong cipher**.
+
+In addition it exposes two plugin for Felix Web Console:
+
+1. To encrypt messages
+2. To list all registered JCA algorithms of all registered JCA providers
 
 See [Sling's documentation for Commons 
Crypto](https://sling.apache.org/documentation/bundles/commons-crypto.html) for 
details.
diff --git 
a/src/main/java/org/apache/sling/commons/crypto/jasypt/internal/JasyptStandardPbeStringCryptoService.java
 
b/src/main/java/org/apache/sling/commons/crypto/jasypt/internal/JasyptStandardPbeStringCryptoService.java
index 3cac9fd..6776f8c 100644
--- 
a/src/main/java/org/apache/sling/commons/crypto/jasypt/internal/JasyptStandardPbeStringCryptoService.java
+++ 
b/src/main/java/org/apache/sling/commons/crypto/jasypt/internal/JasyptStandardPbeStringCryptoService.java
@@ -101,6 +101,7 @@ public final class JasyptStandardPbeStringCryptoService 
implements CryptoService
     }
 
     private void setupEncryptor(final 
JasyptStandardPbeStringCryptoServiceConfiguration configuration) {
+        logger.warn("Using deprecated JasyptStandardPbeStringCryptoService, 
please migrate to the safer JcaPbeCryptoService");
         algorithm = configuration.algorithm();
         final Set<?> algorithms = AlgorithmRegistry.getAllPBEAlgorithms();
         if (!algorithms.contains(algorithm)) {
diff --git 
a/src/main/java/org/apache/sling/commons/crypto/jasypt/internal/package-info.java
 
b/src/main/java/org/apache/sling/commons/crypto/jasypt/internal/package-info.java
index 55be25b..730d7ab 100644
--- 
a/src/main/java/org/apache/sling/commons/crypto/jasypt/internal/package-info.java
+++ 
b/src/main/java/org/apache/sling/commons/crypto/jasypt/internal/package-info.java
@@ -19,5 +19,7 @@
 
 /**
  * Provides an implementation of the Apache Sling Commons Crypto API (Crypto 
Service) based on Jasypt.
+ * @deprecated Use org.apache.sling.commons.crypto.jca instead.
  */
+@Deprecated(since = "1.3.0", forRemoval = true)
 package org.apache.sling.commons.crypto.jasypt.internal;
diff --git 
a/src/main/java/org/apache/sling/commons/crypto/jasypt/package-info.java 
b/src/main/java/org/apache/sling/commons/crypto/jasypt/package-info.java
index 22d3f25..9d84d66 100644
--- a/src/main/java/org/apache/sling/commons/crypto/jasypt/package-info.java
+++ b/src/main/java/org/apache/sling/commons/crypto/jasypt/package-info.java
@@ -19,5 +19,7 @@
 
 /**
  * The Apache Sling Commons Crypto Jasypt root package.
+ * @deprecated Use org.apache.sling.commons.crypto.jca instead.
  */
+@Deprecated(since = "1.3.0", forRemoval = true)
 package org.apache.sling.commons.crypto.jasypt;