Update BouncyCastle to version 1.69

The version 1.69 is chosen instead of 1.70, because the moxie build
would not download the jars, trying to download `...1.7.jar` instead.

Three class deprecations are fixed. `PEMWriter` and `X509Extension`
are replaced with their drop-in replacements `JcaPEMWriter` and
`Extension`. The `PasswordFinder` deprecation note says that "it is
no longer used". It also was never used in Gitblit's code, so it is
removed from the key par provider class.

diff --git a/.classpath b/.classpath
index 7c32205b7824c208331b9f9e61f3d4b86c12a528..394584d32dcbeee73fad5053721ff22b34e0d294 100644 (file)
--- a/.classpath
+++ b/.classpath
@@ -51,9 +51,10 @@
        <classpathentry kind="lib" path="ext/commons-logging-1.1.3.jar" sourcepath="ext/src/commons-logging-1.1.3.jar" />
        <classpathentry kind="lib" path="ext/commons-codec-1.7.jar" sourcepath="ext/src/commons-codec-1.7.jar" />
        <classpathentry kind="lib" path="ext/org.eclipse.jgit.http.server-4.5.7.201904151645-r.jar" sourcepath="ext/src/org.eclipse.jgit.http.server-4.5.7.201904151645-r.jar" />
-       <classpathentry kind="lib" path="ext/bcprov-jdk15on-1.57.jar" sourcepath="ext/src/bcprov-jdk15on-1.57.jar" />
-       <classpathentry kind="lib" path="ext/bcmail-jdk15on-1.57.jar" sourcepath="ext/src/bcmail-jdk15on-1.57.jar" />
-       <classpathentry kind="lib" path="ext/bcpkix-jdk15on-1.57.jar" sourcepath="ext/src/bcpkix-jdk15on-1.57.jar" />
+       <classpathentry kind="lib" path="ext/bcprov-jdk15on-1.69.jar" sourcepath="ext/src/bcprov-jdk15on-1.69.jar" />
+       <classpathentry kind="lib" path="ext/bcmail-jdk15on-1.69.jar" sourcepath="ext/src/bcmail-jdk15on-1.69.jar" />
+       <classpathentry kind="lib" path="ext/bcutil-jdk15on-1.69.jar" sourcepath="ext/src/bcutil-jdk15on-1.69.jar" />
+       <classpathentry kind="lib" path="ext/bcpkix-jdk15on-1.69.jar" sourcepath="ext/src/bcpkix-jdk15on-1.69.jar" />
        <classpathentry kind="lib" path="ext/eddsa-0.2.0.jar" sourcepath="ext/src/eddsa-0.2.0.jar" />
        <classpathentry kind="lib" path="ext/sshd-core-1.7.0.jar" sourcepath="ext/src/sshd-core-1.7.0.jar" />
        <classpathentry kind="lib" path="ext/mina-core-2.0.21.jar" sourcepath="ext/src/mina-core-2.0.21.jar" />

diff --git a/build.moxie b/build.moxie
index 026ab5bbf6e197ee65647e805cd4cbbd9fdd95a3..d78733bf36c910badc5ca4b53af678a5fa8c2b98 100644 (file)
--- a/build.moxie
+++ b/build.moxie
@@ -111,7 +111,7 @@ properties: {
   lucene.version : 5.5.2
   jgit.version   : 4.5.7.201904151645-r
   groovy.version : 2.4.4
-  bouncycastle.version : 1.57
+  bouncycastle.version : 1.69
   selenium.version : 2.28.0
   wikitext.version : 1.4
   sshd.version: 1.7.0

diff --git a/gitblit.iml b/gitblit.iml
index 694cd94f64e0a4447ae61c6fc13ba16439ec2785..e2ed5b0febe141261c7e9954faa0ccd84b82dad7 100644 (file)
--- a/gitblit.iml
+++ b/gitblit.iml
@@ -508,35 +508,46 @@
       </library>
     </orderEntry>
     <orderEntry type="module-library">
-      <library name="bcprov-jdk15on-1.57.jar">
+      <library name="bcprov-jdk15on-1.69.jar">
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/ext/bcprov-jdk15on-1.57.jar!/" />
+          <root url="jar://$MODULE_DIR$/ext/bcprov-jdk15on-1.69.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/ext/src/bcprov-jdk15on-1.57.jar!/" />
+          <root url="jar://$MODULE_DIR$/ext/src/bcprov-jdk15on-1.69.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
     <orderEntry type="module-library">
-      <library name="bcmail-jdk15on-1.57.jar">
+      <library name="bcmail-jdk15on-1.69.jar">
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/ext/bcmail-jdk15on-1.57.jar!/" />
+          <root url="jar://$MODULE_DIR$/ext/bcmail-jdk15on-1.69.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/ext/src/bcmail-jdk15on-1.57.jar!/" />
+          <root url="jar://$MODULE_DIR$/ext/src/bcmail-jdk15on-1.69.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
     <orderEntry type="module-library">
-      <library name="bcpkix-jdk15on-1.57.jar">
+      <library name="bcutil-jdk15on-1.69.jar">
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/ext/bcpkix-jdk15on-1.57.jar!/" />
+          <root url="jar://$MODULE_DIR$/ext/bcutil-jdk15on-1.69.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/ext/src/bcpkix-jdk15on-1.57.jar!/" />
+          <root url="jar://$MODULE_DIR$/ext/src/bcutil-jdk15on-1.69.jar!/" />
+        </SOURCES>
+      </library>
+    </orderEntry>
+    <orderEntry type="module-library">
+      <library name="bcpkix-jdk15on-1.69.jar">
+        <CLASSES>
+          <root url="jar://$MODULE_DIR$/ext/bcpkix-jdk15on-1.69.jar!/" />
+        </CLASSES>
+        <JAVADOC />
+        <SOURCES>
+          <root url="jar://$MODULE_DIR$/ext/src/bcpkix-jdk15on-1.69.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>

diff --git a/src/main/java/com/gitblit/transport/ssh/FileKeyPairProvider.java b/src/main/java/com/gitblit/transport/ssh/FileKeyPairProvider.java
index cc91bb8c1f2902abed607c7dade6b04b0a44c49c..38618baf533b0257a88bdd848ce6b2f9536fb025 100644 (file)
--- a/src/main/java/com/gitblit/transport/ssh/FileKeyPairProvider.java
+++ b/src/main/java/com/gitblit/transport/ssh/FileKeyPairProvider.java
@@ -31,7 +31,6 @@ import org.bouncycastle.openssl.PEMDecryptorProvider;
 import org.bouncycastle.openssl.PEMEncryptedKeyPair;
 import org.bouncycastle.openssl.PEMKeyPair;
 import org.bouncycastle.openssl.PEMParser;
-import org.bouncycastle.openssl.PasswordFinder;
 import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
 import org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder;
 
@@ -46,7 +45,6 @@ import org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder;
 public class FileKeyPairProvider extends AbstractKeyPairProvider {
 
     private String[] files;
-    private PasswordFinder passwordFinder;
 
     public FileKeyPairProvider() {
     }
@@ -55,11 +53,6 @@ public class FileKeyPairProvider extends AbstractKeyPairProvider {
         this.files = files;
     }
 
-    public FileKeyPairProvider(String[] files, PasswordFinder passwordFinder) {
-        this.files = files;
-        this.passwordFinder = passwordFinder;
-    }
-
     public String[] getFiles() {
         return files;
     }
@@ -68,14 +61,6 @@ public class FileKeyPairProvider extends AbstractKeyPairProvider {
         this.files = files;
     }
 
-    public PasswordFinder getPasswordFinder() {
-        return passwordFinder;
-    }
-
-    public void setPasswordFinder(PasswordFinder passwordFinder) {
-        this.passwordFinder = passwordFinder;
-    }
-
     public Iterable<KeyPair> loadKeys() {
         if (!SecurityUtils.isBouncyCastleRegistered()) {
             throw new IllegalStateException("BouncyCastle must be registered as a JCE provider");
@@ -130,12 +115,6 @@ public class FileKeyPairProvider extends AbstractKeyPairProvider {
 
                 JcaPEMKeyConverter pemConverter = new JcaPEMKeyConverter();
                 pemConverter.setProvider("BC");
-                if (passwordFinder != null && o instanceof PEMEncryptedKeyPair) {
-                    JcePEMDecryptorProviderBuilder decryptorBuilder = new JcePEMDecryptorProviderBuilder();
-                    PEMDecryptorProvider pemDecryptor = decryptorBuilder.build(passwordFinder.getPassword());
-                    o = pemConverter.getKeyPair(((PEMEncryptedKeyPair) o).decryptKeyPair(pemDecryptor));
-                }
-
                 if (o instanceof PEMKeyPair) {
                     o = pemConverter.getKeyPair((PEMKeyPair)o);
                     return (KeyPair) o;

diff --git a/src/main/java/com/gitblit/transport/ssh/SshDaemon.java b/src/main/java/com/gitblit/transport/ssh/SshDaemon.java
index 8bb880b0313040d9b4cf58201728057f2b120e81..7a31bc186b595edf80575673952647ad247a71b8 100644 (file)
--- a/src/main/java/com/gitblit/transport/ssh/SshDaemon.java
+++ b/src/main/java/com/gitblit/transport/ssh/SshDaemon.java
@@ -34,7 +34,7 @@ import org.apache.sshd.common.util.security.bouncycastle.BouncyCastleSecurityPro
 import org.apache.sshd.common.util.security.eddsa.EdDSASecurityProviderRegistrar;
 import org.apache.sshd.server.SshServer;
 import org.apache.sshd.server.auth.pubkey.CachingPublicKeyAuthenticator;
-import org.bouncycastle.openssl.PEMWriter;
+import org.bouncycastle.openssl.jcajce.JcaPEMWriter;
 import org.eclipse.jgit.internal.JGitText;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -267,7 +267,7 @@ public class SshDaemon {
             }
 
             FileOutputStream os = new FileOutputStream(file);
-            PEMWriter w = new PEMWriter(new OutputStreamWriter(os));
+            JcaPEMWriter w = new JcaPEMWriter(new OutputStreamWriter(os));
             w.writeObject(kp);
             w.flush();
             w.close();

diff --git a/src/main/java/com/gitblit/utils/X509Utils.java b/src/main/java/com/gitblit/utils/X509Utils.java
index b661922dd4f54cd1f00d95d0f456585e0094cd1c..4626622eeb15ee7b784e0946ff16811eac9797d7 100644 (file)
--- a/src/main/java/com/gitblit/utils/X509Utils.java
+++ b/src/main/java/com/gitblit/utils/X509Utils.java
@@ -72,7 +72,7 @@ import org.bouncycastle.asn1.x509.BasicConstraints;
 import org.bouncycastle.asn1.x509.GeneralName;\r
 import org.bouncycastle.asn1.x509.GeneralNames;\r
 import org.bouncycastle.asn1.x509.KeyUsage;\r
-import org.bouncycastle.asn1.x509.X509Extension;\r
+import org.bouncycastle.asn1.x509.Extension;\r
 import org.bouncycastle.cert.X509CRLHolder;\r
 import org.bouncycastle.cert.X509v2CRLBuilder;\r
 import org.bouncycastle.cert.X509v3CertificateBuilder;\r
@@ -82,7 +82,6 @@ import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
 import org.bouncycastle.jce.PrincipalUtil;\r
 import org.bouncycastle.jce.interfaces.PKCS12BagAttributeCarrier;\r
 import org.bouncycastle.openssl.PEMEncryptor;\r
-import org.bouncycastle.openssl.PEMWriter;\r
 import org.bouncycastle.openssl.jcajce.JcaPEMWriter;\r
 import org.bouncycastle.openssl.jcajce.JcePEMEncryptorBuilder;\r
 import org.bouncycastle.operator.ContentSigner;\r
@@ -445,9 +444,9 @@ public class X509Utils {
                        boolean asPem = targetFile.getName().toLowerCase().endsWith(".pem");\r
                        if (asPem) {\r
                                // PEM encoded X509\r
-                               PEMWriter pemWriter = null;\r
+                               JcaPEMWriter pemWriter = null;\r
                                try {\r
-                                       pemWriter = new PEMWriter(new FileWriter(tmpFile));\r
+                                       pemWriter = new JcaPEMWriter(new FileWriter(tmpFile));\r
                                        pemWriter.writeObject(cert);\r
                                        pemWriter.flush();\r
                                } finally {\r
@@ -560,9 +559,9 @@ public class X509Utils {
                                        pair.getPublic());\r
 \r
                        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();\r
-                       certBuilder.addExtension(X509Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(pair.getPublic()));\r
-                       certBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));\r
-                       certBuilder.addExtension(X509Extension.authorityKeyIdentifier, false, extUtils.createAuthorityKeyIdentifier(caCert.getPublicKey()));\r
+                       certBuilder.addExtension(Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(pair.getPublic()));\r
+                       certBuilder.addExtension(Extension.basicConstraints, false, new BasicConstraints(false));\r
+                       certBuilder.addExtension(Extension.authorityKeyIdentifier, false, extUtils.createAuthorityKeyIdentifier(caCert.getPublicKey()));\r
 \r
                        // support alternateSubjectNames for SSL certificates\r
                        List<GeneralName> altNames = new ArrayList<GeneralName>();\r
@@ -571,7 +570,7 @@ public class X509Utils {
                        }\r
                        if (altNames.size() > 0) {\r
                                GeneralNames subjectAltName = new GeneralNames(altNames.toArray(new GeneralName [altNames.size()]));\r
-                               certBuilder.addExtension(X509Extension.subjectAlternativeName, false, subjectAltName);\r
+                               certBuilder.addExtension(Extension.subjectAlternativeName, false, subjectAltName);\r
                        }\r
 \r
                        ContentSigner caSigner = new JcaContentSignerBuilder(SIGNING_ALGORITHM)\r
@@ -629,10 +628,10 @@ public class X509Utils {
                                        caPair.getPublic());\r
 \r
                        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();\r
-                       caBuilder.addExtension(X509Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(caPair.getPublic()));\r
-                       caBuilder.addExtension(X509Extension.authorityKeyIdentifier, false, extUtils.createAuthorityKeyIdentifier(caPair.getPublic()));\r
-                       caBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(true));\r
-                       caBuilder.addExtension(X509Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));\r
+                       caBuilder.addExtension(Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(caPair.getPublic()));\r
+                       caBuilder.addExtension(Extension.authorityKeyIdentifier, false, extUtils.createAuthorityKeyIdentifier(caPair.getPublic()));\r
+                       caBuilder.addExtension(Extension.basicConstraints, false, new BasicConstraints(true));\r
+                       caBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));\r
 \r
                        JcaX509CertificateConverter converter = new JcaX509CertificateConverter().setProvider(BC);\r
                        X509Certificate cert = converter.getCertificate(caBuilder.build(caSigner));\r
@@ -862,14 +861,14 @@ public class X509Utils {
                                        pair.getPublic());\r
 \r
                        JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();\r
-                       certBuilder.addExtension(X509Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(pair.getPublic()));\r
-                       certBuilder.addExtension(X509Extension.basicConstraints, false, new BasicConstraints(false));\r
-                       certBuilder.addExtension(X509Extension.authorityKeyIdentifier, false, extUtils.createAuthorityKeyIdentifier(caCert.getPublicKey()));\r
-                       certBuilder.addExtension(X509Extension.keyUsage, true, new KeyUsage(KeyUsage.keyEncipherment | KeyUsage.digitalSignature));\r
+                       certBuilder.addExtension(Extension.subjectKeyIdentifier, false, extUtils.createSubjectKeyIdentifier(pair.getPublic()));\r
+                       certBuilder.addExtension(Extension.basicConstraints, false, new BasicConstraints(false));\r
+                       certBuilder.addExtension(Extension.authorityKeyIdentifier, false, extUtils.createAuthorityKeyIdentifier(caCert.getPublicKey()));\r
+                       certBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.keyEncipherment | KeyUsage.digitalSignature));\r
                        if (!StringUtils.isEmpty(clientMetadata.emailAddress)) {\r
                                GeneralNames subjectAltName = new GeneralNames(\r
                     new GeneralName(GeneralName.rfc822Name, clientMetadata.emailAddress));\r
-                               certBuilder.addExtension(X509Extension.subjectAlternativeName, false, subjectAltName);\r
+                               certBuilder.addExtension(Extension.subjectAlternativeName, false, subjectAltName);\r
                        }\r
 \r
                        ContentSigner signer = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider(BC).build(caPrivateKey);\r