Partha Sarathy Maripini created QPID-8777:
---------------------------------------------
Summary: [Broker-J] Implement BC-FIPS certificate generator plugin
using explicit provider instances
Key: QPID-8777
URL: https://issues.apache.org/jira/browse/QPID-8777
Project: Qpid
Issue Type: Sub-task
Components: Broker-J
Reporter: Partha Sarathy Maripini
*Background:*
FIPS 140 compliance requires certificate generation to run strictly within a
validated cryptographic boundary without modifying global JVM security state
via Security.addProvider().
*Tasks:*
1. Create a separate Maven module `qpid-broker-plugins-cert-generator-bcfips`
depending on `org.bouncycastle:bc-fips`.
2. Implement `CertificateGeneratorProvider` using explicit
`BouncyCastleFipsProvider` instances passed directly to key pair generators and
signature builders.
3. Ensure no static initializers or constructors trigger thread-specific
"Approved-Only" state during QpidServiceLoader discovery scanning.
*Acceptance Criteria:*
- BC-FIPS certificate generator successfully creates self-signed certificates.
- Operations do not execute Security.addProvider() or mutate the shared JVM
provider registry.
- Plugin discovery produces no security-policy side-effects.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
