Re: [9] RFR 8134487:updated sun/security/ssl/StatusStapling/* to work with modules

2016-02-17 Thread Tim Du
Hi Alan: On 2/16/2016 7:25 PM, Alan Bateman wrote: On 16/02/2016 11:05, Tim Du wrote: Hi Alan: I tried @compile/module to fix this issue before, but it does not work ,Use CertStatusReqExtensionTests.java as example, the process as below: 1. Create java.base/sun/security/ssl folder in test

Re: [9] RFR 8134487:updated sun/security/ssl/StatusStapling/* to work with modules

2016-02-17 Thread Alan Bateman
On 17/02/2016 08:19, Tim Du wrote: Follow you suggestion, I updated the code as below: 1.Create java.base/sun/security/ssl under test/sun/security/ssl/StatusStapling/, move all test files and dependency class into java.base/sun/security/ssl ,removed the jtreg label from test java files. 2.Cr

Re: [9] RFR 8134487:updated sun/security/ssl/StatusStapling/* to work with modules

2016-02-17 Thread Tim Du
On 2/17/2016 4:23 PM, Alan Bateman wrote: On 17/02/2016 08:19, Tim Du wrote: Follow you suggestion, I updated the code as below: 1.Create java.base/sun/security/ssl under test/sun/security/ssl/StatusStapling/, move all test files and dependency class into java.base/sun/security/ssl ,removed

Re: [9] RFR 8134487:updated sun/security/ssl/StatusStapling/* to work with modules

2016-02-17 Thread Alan Bateman
On 17/02/2016 09:57, Tim Du wrote: Sure. I am aslo updated java.base/sun/security/testlibrary to test/java/security/testlibrary/ , so that keep the testlibrary files could be reused by other tests. Re-generate the latest webrev is http://cr.openjdk.java.net/~tidu/8134487/webrev.03/ , Thanks

Re: RFR 8130302: jarsigner and keytool -providerClass needs be re-examined for modules

2016-02-17 Thread Alan Bateman
On 17/02/2016 01:20, Weijun Wang wrote: : Technically they are independent. With -providerClass/-providerArg, the provider is added into system and getInstance() calls (of keyStore, KeyPairGenerator, etc) can use it. On the other hand, -providerName can be used to specifically tell KeyPairG

Re: jmx-dev [ping] Re: RFR 8145919: sun/management/jmxremote/bootstrap/RmiSslBootstrapTest failed with Connection failed for no credentials (Round 2)

2016-02-17 Thread Jaroslav Bachorik
On 16.2.2016 11:56, Daniel Fuchs wrote: Hi Jaroslav, I have no objection to this change. Could you add a comment somewhere to explain how you generated the truststore and keystore - in case we need to tweak that again in the future? I've added a simple readme file next to the keystores. http

JDK 9 RFR of JDK-8149922: Remove intermittent key from security tests

2016-02-17 Thread Amy Lu
sun/security/mscapi/ShortRSAKey1024.sh sun/security/mscapi/SignUsingSHA2withRSA.sh javax/net/ssl/SSLSession/SessionCacheSizeTests.java For above tests, previous intermittent test failure issues are fixed, no open bug (no failure reported). This patch is to remove @key intermittent from tests.

Re: JDK 9 RFR of JDK-8149922: Remove intermittent key from security tests

2016-02-17 Thread Xuelei Fan
Looks fine to me. Thanks, Xuelei On 2/17/2016 9:11 PM, Amy Lu wrote: > sun/security/mscapi/ShortRSAKey1024.sh > sun/security/mscapi/SignUsingSHA2withRSA.sh > javax/net/ssl/SSLSession/SessionCacheSizeTests.java > > For above tests, previous intermittent test failure issues are fixed, no > open bu

Re: RFR 8130302: jarsigner and keytool -providerClass needs be re-examined for modules

2016-02-17 Thread Weijun Wang
On 2/17/2016 18:33, Alan Bateman wrote: On 17/02/2016 01:20, Weijun Wang wrote: : Technically they are independent. With -providerClass/-providerArg, the provider is added into system and getInstance() calls (of keyStore, KeyPairGenerator, etc) can use it. On the other hand, -providerName c

Re: jmx-dev [ping] Re: RFR 8145919: sun/management/jmxremote/bootstrap/RmiSslBootstrapTest failed with Connection failed for no credentials (Round 2)

2016-02-17 Thread Daniel Fuchs
Thanks Jaroslav, that's great! If these certificates have an expiration date then it's possible that we will have to regenerate them from time to time... cheers, -- daniel On 17/02/16 13:13, Jaroslav Bachorik wrote: On 16.2.2016 11:56, Daniel Fuchs wrote: Hi Jaroslav, I have no objection to

Re: Code Review Request 8139565 Restrict certificates with DSA keys less than 1024 bits

2016-02-17 Thread Xuelei Fan
Hi Sean, Thanks for the review. I find a new bug in KeyUtil.java, plan to fix in the same update. Please review the KeyUtil update: http://cr.openjdk.java.net/~xuelei/8139565/webrev.02/ The DSA parameter may not present in a X.509 certificate. The return value of DSAKey.getParams() may be n

Re: [9] RFR 8134487:updated sun/security/ssl/StatusStapling/* to work with modules

2016-02-17 Thread Alan Bateman
On 17/02/2016 09:57, Tim Du wrote: Sure. I am aslo updated java.base/sun/security/testlibrary to test/java/security/testlibrary/ , so that keep the testlibrary files could be reused by other tests. Re-generate the latest webrev is http://cr.openjdk.java.net/~tidu/8134487/webrev.03/ , Thanks.

Lets encrypt in root program

2016-02-17 Thread Bernd
Hello, SSL Servers with certificates issued by Let's encrypt start to come up more and more, but it looks like the default cacert store of recent java 8 SEs do not trust them. Neighter the ISRG root nor the cross signed certificate. According to this thread lots of people have a need for it: htt

Re: Lets encrypt in root program

2016-02-17 Thread dalibor topic
On 17.02.2016 18:40, Bernd wrote: Oracle root cert program, There are no root certificates in OpenJDK. If you'd like to add specific root certificates to your own builds, please consult the build instructions. This mailing list is for OpenJDK development specifically. Inquiries about Oracle

Re: RFR 8130302: jarsigner and keytool -providerClass needs be re-examined for modules

2016-02-17 Thread Mandy Chung
> On Feb 16, 2016, at 5:20 PM, Weijun Wang wrote: > > > > On 2/16/2016 22:54, Alan Bateman wrote: >> >> On 16/02/2016 14:44, Weijun Wang wrote: >>> Please review the code change at >>> >>> http://cr.openjdk.java.net/~weijun/8130302/webrev.00/ >>> >>> I didn't abandon -providerClass and go

Re: Code Review Request 8139565 Restrict certificates with DSA keys less than 1024 bits

2016-02-17 Thread Sean Mullan
Looks fine. --Sean On 02/17/2016 10:24 AM, Xuelei Fan wrote: Hi Sean, Thanks for the review. I find a new bug in KeyUtil.java, plan to fix in the same update. Please review the KeyUtil update: http://cr.openjdk.java.net/~xuelei/8139565/webrev.02/ The DSA parameter may not present in a

Re: RFR 8130302: jarsigner and keytool -providerClass needs be re-examined for modules

2016-02-17 Thread Wang Weijun
> On Feb 18, 2016, at 5:15 AM, Mandy Chung wrote: > > Can I say -providerClass -providerArg is equivalent to extending > java.security to add “security.provider.N=NAME ARG”? Yes. > > I suggest to keep -providerClass and -providerArg only for legacy security > provider (i.e. not a service

JEP Review Request: SHA-3 Hash Algorithm

2016-02-17 Thread Valerie Peng
Please review this drafted JEP for adding SHA-3 Hash Algorithm support to JDK 9: https://bugs.openjdk.java.net/browse/JDK-8064399 Thanks, Valerie

Re: RFR 8130302: jarsigner and keytool -providerClass needs be re-examined for modules

2016-02-17 Thread Mandy Chung
> On Feb 17, 2016, at 4:46 PM, Wang Weijun wrote: > > >> On Feb 18, 2016, at 5:15 AM, Mandy Chung wrote: >> >> Can I say -providerClass -providerArg is equivalent to >> extending java.security to add “security.provider.N=NAME ARG”? > > Yes. > >> >> I suggest to keep -providerClass and -

Re: Code Review Request 8149417 Use final restricted flag

2016-02-17 Thread Xuelei Fan
Hi, A new test case was added. Please review the update: http://cr.openjdk.java.net/~xuelei/8149417/webrev.01/ Thanks, Xuelei On 2/15/2016 9:07 PM, Sean Mullan wrote: > Looks good. > > --Sean > > On 02/15/2016 01:33 AM, Xuelei Fan wrote: >> Hi, >> >> Please review this code cleanup: >> >>

Re: Code Review Request 8149417 Use final restricted flag

2016-02-17 Thread Wang Weijun
IMO a noreg-trivial is enough. --Max > 在 2016年2月18日,09:28,Xuelei Fan 写道: > > Hi, > > A new test case was added. Please review the update: > > http://cr.openjdk.java.net/~xuelei/8149417/webrev.01/ > > Thanks, > Xuelei > >> On 2/15/2016 9:07 PM, Sean Mullan wrote: >> Looks good. >> >> --

Re: [9] RFR 8134487:updated sun/security/ssl/StatusStapling/* to work with modules

2016-02-17 Thread Tim Du
On 2/17/2016 11:40 PM, Alan Bateman wrote: On 17/02/2016 09:57, Tim Du wrote: Sure. I am aslo updated java.base/sun/security/testlibrary to test/java/security/testlibrary/ , so that keep the testlibrary files could be reused by other tests. Re-generate the latest webrev is http://cr.openjdk.j

Re: RFR 8130302: jarsigner and keytool -providerClass needs be re-examined for modules

2016-02-17 Thread Wang Weijun
> On Feb 18, 2016, at 9:21 AM, Mandy Chung wrote: > >> >> On Feb 17, 2016, at 4:46 PM, Wang Weijun wrote: >> >> >>> On Feb 18, 2016, at 5:15 AM, Mandy Chung wrote: >>> >>> Can I say -providerClass -providerArg is equivalent to >>> extending java.security to add “security.provider.N=NAME

Re: RFR 8130302: jarsigner and keytool -providerClass needs be re-examined for modules

2016-02-17 Thread Mandy Chung
> On Feb 17, 2016, at 8:04 PM, Wang Weijun wrote: > >> >> On Feb 18, 2016, at 9:21 AM, Mandy Chung wrote: >> >>> >>> On Feb 17, 2016, at 4:46 PM, Wang Weijun wrote: >>> >>> On Feb 18, 2016, at 5:15 AM, Mandy Chung wrote: Can I say -providerClass -providerArg is equivale