araiprof opened a new pull request, #647: URL: https://github.com/apache/ws-wss4j/pull/647
## Summary - replace the Bouncy Castle ASN.1 calls used to read SubjectKeyIdentifier and AuthorityKeyIdentifier extensions with the existing WSS4J DER decoder - preserve the existing empty-array behavior for absent extensions and null behavior for an AKI without a keyIdentifier - reject truncated, trailing, indefinite-length, overflow, and non-minimal DER encodings ## Motivation ws-security-common declares the Bouncy Castle artifacts as optional, but these key-identifier paths directly linked BC classes. That meant core certificate handling could fail when those optional artifacts were absent. X509Certificate already exposes the encoded extension values, so the small amount of required DER structure can be decoded without selecting or registering a cryptographic provider. This does not change cryptographic primitive selection and does not make Cryptacular optional. OpenSAML/SAML users still retain their existing dependency path. The public BouncyCastleUtils name and methods are retained for source and binary compatibility. Malformed encodings are now rejected more strictly; X.509 extensions are required to use DER. ## Verification - targeted AuthorityKeyIdentifierTest: 5 tests passed - ws-security-common reactor: 4,086 tests passed - full mvn test reactor: 5,252 tests passed, 0 failures/errors, 14 skipped on JDK 26 - minimal runtime check with BC and Cryptacular absent: SKI and AKI extraction passed -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
