[
https://issues.apache.org/jira/browse/PROTON-2971?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Timothy A. Bish updated PROTON-2971:
------------------------------------
Affects Version/s: proton-j-0.35.0
(was: protonj2-1.3.0)
> Hardcoded Bouncy Castle dependency is present in SslEngineFacadeFactory
> -----------------------------------------------------------------------
>
> Key: PROTON-2971
> URL: https://issues.apache.org/jira/browse/PROTON-2971
> Project: Qpid Proton
> Issue Type: Bug
> Components: proton-j
> Affects Versions: proton-j-0.35.0
> Reporter: Sandeep Kulkarni
> Priority: Major
>
> Reference:
> https://github.com/apache/qpid-proton-j/blob/main/proton-j/src/main/java/org/apache/qpid/proton/engine/impl/ssl/SslEngineFacadeFactory.java
> We have Proton-j as transitive dependency in our application coming via Azure
> Service Bus SDK. It comes via package {*}com.azure:azure-sdk-bom{*}.
> Currently hardcoded Bouncy Castle dependency is present in Proton-j for
> PEMParser class instead of using provided security provider by the
> application. That too without having Bouncy Castle as a proper defined
> dependency. It is used via reflection which is generally not recommended.
> Our project does not use Bouncy Castle, instead makes use of SafeLogic Crypto
> Comply as security provider. Refer:
> https://www.safelogic.com/products/cryptocomply-cryptography-software/
> It does not have any class that qualifies for following package:
> org.bouncycastle.util.io.pem.PemReader
> But the PemReader class (com.safelogic.cryptocomply.util.io.pem.PemReader)
> remains available in SafeLogic CCJ without any changes.
> Can you make the required changes to SslEngineFacadeFactory.java so that it
> does not use any reflection and does not require Bouncy Castle as a mandatory
> requirement and allows use of other security providers?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
