From d66873a765018d5477c941cea091b4ac25b0abfe Mon Sep 17 00:00:00 2001
From: PJ Fanning <fanningpj@apache.org>
Date: Thu, 21 Mar 2019 10:23:05 +0000
Subject: [PATCH] upgrade bouncycastle and curvesapi

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1855978 13f79535-47bb-0310-9956-ffa450edef68
---
 .classpath                                    |  6 ++---
 build.gradle                                  |  4 ++--
 build.xml                                     | 22 ++++++++++---------
 maven/poi-ooxml.pom                           |  2 +-
 sonar/ooxml/pom.xml                           |  6 ++---
 .../poi/poifs/crypt/dsig/SignatureInfo.java   |  2 +-
 6 files changed, 22 insertions(+), 20 deletions(-)

diff --git a/.classpath b/.classpath
index b953470841..6c3084ee23 100644
--- a/.classpath
+++ b/.classpath
@@ -21,15 +21,15 @@
 	<classpathentry exported="true" kind="lib" path="ooxml-lib/xmlbeans-3.0.3.jar" sourcepath="ooxml-lib/xmlbeans-3.0.3.jar"/>
 	<classpathentry kind="lib" path="lib/hamcrest-core-1.3.jar"/>
 	<classpathentry kind="lib" path="lib/junit-4.12.jar"/>
-	<classpathentry kind="lib" path="ooxml-lib/curvesapi-1.05.jar"/>
+	<classpathentry kind="lib" path="ooxml-lib/curvesapi-1.06.jar"/>
 	<classpathentry exported="true" kind="lib" path="ooxml-lib/ooxml-schemas-1.4.jar" sourcepath="ooxml-lib/ooxml-schemas-1.4-sources.jar"/>
 	<classpathentry exported="true" kind="lib" path="ooxml-lib/ooxml-security-1.1.jar" sourcepath="ooxml-lib/ooxml-security-1.1-sources.jar"/>
 	<classpathentry kind="lib" path="lib/jmh-core-1.19.jar"/>
 	<classpathentry kind="lib" path="lib/jmh-generator-annprocess-1.19.jar"/>
 	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.8"/>
 	<classpathentry exported="true" kind="lib" path="compile-lib/slf4j-api-1.7.25.jar"/>
-	<classpathentry kind="lib" path="compile-lib/bcpkix-jdk15on-1.60.jar"/>
-	<classpathentry kind="lib" path="compile-lib/bcprov-ext-jdk15on-1.60.jar"/>
+	<classpathentry kind="lib" path="compile-lib/bcpkix-jdk15on-1.61.jar"/>
+	<classpathentry kind="lib" path="compile-lib/bcprov-ext-jdk15on-1.61.jar"/>
 	<classpathentry kind="lib" path="ooxml-testlib/reflections.jar"/>
 	<classpathentry kind="lib" path="ooxml-testlib/guava.jar"/>
 	<classpathentry kind="lib" path="ooxml-testlib/javassist.jar"/>
diff --git a/build.gradle b/build.gradle
index 04341a114f..2d574fed04 100644
--- a/build.gradle
+++ b/build.gradle
@@ -235,8 +235,8 @@ project('ooxml') {
         compile 'org.apache.commons:commons-math3:3.6.1'
         compile 'org.apache.commons:commons-compress:1.18'
         compile 'org.apache.santuario:xmlsec:2.1.0'
-        compile 'org.bouncycastle:bcpkix-jdk15on:1.60'
-        compile 'com.github.virtuald:curvesapi:1.05'
+        compile 'org.bouncycastle:bcpkix-jdk15on:1.61'
+        compile 'com.github.virtuald:curvesapi:1.06'
 
         // compile only, don't add it to our dist as it blows up the size
         compile 'org.apache.xmlgraphics:batik-all:1.10'
diff --git a/build.xml b/build.xml
index 72c79fb566..e794387d29 100644
--- a/build.xml
+++ b/build.xml
@@ -222,10 +222,10 @@ under the License.
     <!-- xml signature libs -->
     <property name="dsig.xmlsec.jar" location="${compile.lib}/xmlsec-2.1.0.jar"/>
     <property name="dsig.xmlsec.url" value="${repository.m2}/maven2/org/apache/santuario/xmlsec/2.1.0/xmlsec-2.1.0.jar"/>
-    <property name="dsig.bouncycastle-prov.jar" location="${compile.lib}/bcprov-ext-jdk15on-1.60.jar"/>
-    <property name="dsig.bouncycastle-prov.url" value="${repository.m2}/maven2/org/bouncycastle/bcprov-ext-jdk15on/1.60/bcprov-ext-jdk15on-1.60.jar"/>
-    <property name="dsig.bouncycastle-pkix.jar" location="${compile.lib}/bcpkix-jdk15on-1.60.jar"/>
-    <property name="dsig.bouncycastle-pkix.url" value="${repository.m2}/maven2/org/bouncycastle/bcpkix-jdk15on/1.60/bcpkix-jdk15on-1.60.jar"/>
+    <property name="dsig.bouncycastle-prov.jar" location="${compile.lib}/bcprov-ext-jdk15on-1.61.jar"/>
+    <property name="dsig.bouncycastle-prov.url" value="${repository.m2}/maven2/org/bouncycastle/bcprov-ext-jdk15on/1.61/bcprov-ext-jdk15on-1.61.jar"/>
+    <property name="dsig.bouncycastle-pkix.jar" location="${compile.lib}/bcpkix-jdk15on-1.61.jar"/>
+    <property name="dsig.bouncycastle-pkix.url" value="${repository.m2}/maven2/org/bouncycastle/bcpkix-jdk15on/1.61/bcpkix-jdk15on-1.61.jar"/>
     <property name="dsig.sl4j-api.jar" location="${compile.lib}/slf4j-api-1.7.25.jar"/>
     <property name="dsig.sl4j-api.url" value="${repository.m2}/maven2/org/slf4j/slf4j-api/1.7.25/slf4j-api-1.7.25.jar"/>
 
@@ -238,9 +238,9 @@ under the License.
     <property name="svg.xmlgraphics-commons.jar" value="${compile.lib}/xmlgraphics-commons-2.3.jar"/>
 
     <!-- jars in the ooxml-lib directory, see the fetch-ooxml-jars target-->
-    <property name="ooxml.curvesapi.jar" location="${ooxml.lib}/curvesapi-1.05.jar"/>
+    <property name="ooxml.curvesapi.jar" location="${ooxml.lib}/curvesapi-1.06.jar"/>
     <property name="ooxml.curvesapi.url"
-              value="${repository.m2}/maven2/com/github/virtuald/curvesapi/1.05/curvesapi-1.05.jar"/>
+              value="${repository.m2}/maven2/com/github/virtuald/curvesapi/1.06/curvesapi-1.06.jar"/>
     <property name="ooxml.xmlbeans.jar" location="${ooxml.lib}/xmlbeans-3.0.3.jar"/>
     <property name="ooxml.xmlbeans.url"
               value="https://repository.apache.org/content/repositories/staging/org/apache/xmlbeans/xmlbeans/3.0.3/xmlbeans-3.0.3.jar"/>
@@ -322,10 +322,10 @@ under the License.
     <property name="halt.on.test.failure" value="true"/>
 
     <!-- helper jars for pgp signing, building and nexus staging -->
-    <property name="dist.bouncycastle-prov.jar" location="${compile.lib}/bcprov-ext-jdk15on-1.60.jar"/>
-    <property name="dist.bouncycastle-prov.url" value="${repository.m2}/maven2/org/bouncycastle/bcprov-ext-jdk15on/1.60/bcprov-ext-jdk15on-1.60.jar"/>
-    <property name="dist.bouncycastle-bcpg.jar" location="${compile.lib}/bcpg-jdk15on-1.60.jar"/>
-    <property name="dist.bouncycastle-bcpg.url" value="${repository.m2}/maven2/org/bouncycastle/bcpg-jdk15on/1.60/bcpg-jdk15on-1.60.jar"/>
+    <property name="dist.bouncycastle-prov.jar" location="${compile.lib}/bcprov-ext-jdk15on-1.61.jar"/>
+    <property name="dist.bouncycastle-prov.url" value="${repository.m2}/maven2/org/bouncycastle/bcprov-ext-jdk15on/1.61/bcprov-ext-jdk15on-1.61.jar"/>
+    <property name="dist.bouncycastle-bcpg.jar" location="${compile.lib}/bcpg-jdk15on-1.61.jar"/>
+    <property name="dist.bouncycastle-bcpg.url" value="${repository.m2}/maven2/org/bouncycastle/bcpg-jdk15on/1.61/bcpg-jdk15on-1.61.jar"/>
     <property name="dist.commons-openpgp.jar" location="${compile.lib}/commons-openpgp-1.0-SNAPSHOT.jar"/>
     <property name="dist.commons-openpgp.url" value="https://repository.apache.org/snapshots/org/apache/commons/commons-openpgp/1.0-SNAPSHOT/commons-openpgp-1.0-20140717.171036-11.jar"/>
     <property name="dist.nexus-staging.jar" location="${compile.lib}/nexus-staging-ant-tasks-1.6.3-uber.jar"/>
@@ -705,6 +705,7 @@ under the License.
                 <include name="ooxml-security-1.0.jar"/>
                 <include name="curvesapi-1.03.jar"/>
                 <include name="curvesapi-1.04.jar"/>
+                <include name="curvesapi-1.05.jar"/>
                 <include name="xmlbeans-2.*.jar"/>
                 <include name="xmlbeans-3.0.0.jar"/>
                 <include name="xmlbeans-3.0.1.jar"/>
@@ -716,6 +717,7 @@ under the License.
                 <include name="xmlsec-2.0.5.jar"/>
                 <include name="xmlsec-2.0.6.jar"/>
                 <include name="bc*jdk15on-1.5*.jar"/>
+                <include name="bc*jdk15on-1.60*.jar"/>
                 <include name="slf4j-api-1.7.7.jar"/>
                 <include name="slf4j-api-1.7.12.jar"/>
             </fileset>
diff --git a/maven/poi-ooxml.pom b/maven/poi-ooxml.pom
index 5350148c13..3b41f89c83 100644
--- a/maven/poi-ooxml.pom
+++ b/maven/poi-ooxml.pom
@@ -77,7 +77,7 @@
     <dependency>
       <groupId>com.github.virtuald</groupId>
       <artifactId>curvesapi</artifactId>
-      <version>1.05</version>
+      <version>1.06</version>
     </dependency>
   </dependencies>
 </project>
diff --git a/sonar/ooxml/pom.xml b/sonar/ooxml/pom.xml
index 7de88404cc..41267d0d9e 100644
--- a/sonar/ooxml/pom.xml
+++ b/sonar/ooxml/pom.xml
@@ -137,12 +137,12 @@
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcpkix-jdk15on</artifactId>
-            <version>1.60</version>
+            <version>1.61</version>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcprov-jdk15on</artifactId>
-            <version>1.60</version>
+            <version>1.61</version>
         </dependency>
         <dependency>
             <groupId>org.apache.santuario</groupId>
@@ -157,7 +157,7 @@
         <dependency>
             <groupId>com.github.virtuald</groupId>
             <artifactId>curvesapi</artifactId>
-            <version>1.05</version>
+            <version>1.06</version>
         </dependency>
   
         <dependency>
diff --git a/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java b/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
index 1cb6e3ca1d..006dd94051 100644
--- a/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
+++ b/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
@@ -149,7 +149,7 @@ import org.w3c.dom.events.EventTarget;
  * <p>To use SignatureInfo and its sibling classes, you'll need to have the following libs
  * in the classpath:</p>
  * <ul>
- * <li>BouncyCastle bcpkix and bcprov (tested against 1.60)</li>
+ * <li>BouncyCastle bcpkix and bcprov (tested against 1.61)</li>
  * <li>Apache Santuario "xmlsec" (tested against 2.1.0)</li>
  * <li>and slf4j-api (tested against 1.7.25)</li>
  * </ul>
-- 
2.39.5