Sandeep Kulkarni created PROTON-2971:
----------------------------------------
Summary: Hardcoded Bouncy Castle dependency is present in
SslEngineFacadeFactory
Key: PROTON-2971
URL: https://issues.apache.org/jira/browse/PROTON-2971
Project: Qpid Proton
Issue Type: Bug
Components: proton-j
Affects Versions: protonj2-1.3.0
Reporter: Sandeep Kulkarni
Reference:
https://github.com/apache/qpid-proton-j/blob/main/proton-j/src/main/java/org/apache/qpid/proton/engine/impl/ssl/SslEngineFacadeFactory.java
We have Proton-j as transitive dependency in our application coming via Azure
Service Bus SDK. It comes via package {*}com.azure:azure-sdk-bom{*}.
Currently hardcoded Bouncy Castle dependency is present in Proton-j for
PEMParser class instead of using provided security provider by the application.
That too without having Bouncy Castle as a proper defined dependency. It is
used via reflection which is generally not recommended.
Our project does not use Bouncy Castle, instead makes use of SafeLogic Crypto
Comply as security provider. Refer:
https://www.safelogic.com/products/cryptocomply-cryptography-software/
It does not have any class that qualifies for following package:
org.bouncycastle.util.io.pem.PemReader
But the PemReader class (com.safelogic.cryptocomply.util.io.pem.PemReader)
remains available in SafeLogic CCJ without any changes.
Can you make the required changes to SslEngineFacadeFactory.java so that it
does not use any reflection and does not require Bouncy Castle as a mandatory
requirement and allows use of other security providers?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
