From 6634e0aa410a2afb028992c2c47038635332d701 Mon Sep 17 00:00:00 2001 From: Lari Hotari Date: Mon, 17 Aug 2026 17:56:55 +0300 Subject: [PATCH 1/2] [improve][build] Upgrade BouncyCastle to 1.85 and BouncyCastle FIPS to 2.1.x Non-FIPS: - bcpkix-jdk18on / bctls-jdk18on 1.84 -> 1.85 - bcprov-jdk18on 1.84 -> 1.85.2 bcprov now uses its own 'bouncycastle-bcprov' version reference. BouncyCastle published a provider-only patch release 1.85.2 that was not released for bcpkix-jdk18on or bctls-jdk18on, so a single shared version reference can no longer cover all three. FIPS: - bc-fips 2.0.1 -> 2.1.3 - bcpkix-fips 2.0.11 -> 2.1.12 - bcutil-fips 2.0.6 -> 2.1.7 Note for operators running Pulsar in FIPS mode: BC-FJA 2.1.x is a different FIPS 140-3 certified module than 2.0.x (Certificate #4943), certified for Java 8, 11, 17 and 21. This upgrade therefore swaps the certified cryptographic module, which may require re-validation depending on your compliance process. BouncyCastle publishes no formal 1.85 release notes; 1.85 is feature-additive over 1.84 (post-quantum signature algorithms, BLS12-381, BIP-340 Taproot, hybrid X.509 certificates). Assisted-by: Claude Code (Opus 5) --- distribution/server/src/assemble/LICENSE.bin.txt | 6 +++--- distribution/shell/src/assemble/LICENSE.bin.txt | 6 +++--- gradle/libs.versions.toml | 13 ++++++++----- 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt index 1dfdb56f59627..fe7f856f711ac 100644 --- a/distribution/server/src/assemble/LICENSE.bin.txt +++ b/distribution/server/src/assemble/LICENSE.bin.txt @@ -625,9 +625,9 @@ Public Domain (CC0) -- ../licenses/LICENSE-CC0.txt Bouncy Castle License * Bouncy Castle -- ../licenses/LICENSE-bouncycastle.txt - - org.bouncycastle-bcpkix-jdk18on-1.84.jar - - org.bouncycastle-bcprov-jdk18on-1.84.jar - - org.bouncycastle-bcutil-jdk18on-1.84.jar + - org.bouncycastle-bcpkix-jdk18on-1.85.jar + - org.bouncycastle-bcprov-jdk18on-1.85.2.jar + - org.bouncycastle-bcutil-jdk18on-1.85.jar ------------------------ diff --git a/distribution/shell/src/assemble/LICENSE.bin.txt b/distribution/shell/src/assemble/LICENSE.bin.txt index 0a31e1e1ed931..3664b02953bab 100644 --- a/distribution/shell/src/assemble/LICENSE.bin.txt +++ b/distribution/shell/src/assemble/LICENSE.bin.txt @@ -473,9 +473,9 @@ Public Domain (CC0) -- ../licenses/LICENSE-CC0.txt Bouncy Castle License * Bouncy Castle -- ../licenses/LICENSE-bouncycastle.txt - - bcpkix-jdk18on-1.84.jar - - bcprov-jdk18on-1.84.jar - - bcutil-jdk18on-1.84.jar + - bcpkix-jdk18on-1.85.jar + - bcprov-jdk18on-1.85.2.jar + - bcutil-jdk18on-1.85.jar ------------------------ diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index df634b55a28f2..9fca42a4a0af6 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -55,10 +55,13 @@ commons-logging = "1.3.6" commons-beanutils = "1.11.0" commons-configuration2 = "2.15.1" # BouncyCastle -bouncycastle = "1.84" -bouncycastle-bcpkix-fips = "2.0.11" -bouncycastle-bcutil-fips = "2.0.6" -bouncycastle-bc-fips = "2.0.1" +bouncycastle = "1.85" +# bcprov is versioned separately: BouncyCastle shipped a provider-only patch release (1.85.2) +# that was not published for bcpkix-jdk18on or bctls-jdk18on, which remain at 1.85 +bouncycastle-bcprov = "1.85.2" +bouncycastle-bcpkix-fips = "2.1.12" +bouncycastle-bcutil-fips = "2.1.7" +bouncycastle-bc-fips = "2.1.3" # Serialization avro = "1.12.0" gson = "2.13.2" @@ -458,7 +461,7 @@ athenz-cert-refresher = { module = "com.yahoo.athenz:athenz-cert-refresher", ver athenz-auth-core = { module = "com.yahoo.athenz:athenz-auth-core", version.ref = "athenz" } athenz-zpe-java-client = { module = "com.yahoo.athenz:athenz-zpe-java-client", version.ref = "athenz" } # Misc -bcprov-jdk18on = { module = "org.bouncycastle:bcprov-jdk18on", version.ref = "bouncycastle" } +bcprov-jdk18on = { module = "org.bouncycastle:bcprov-jdk18on", version.ref = "bouncycastle-bcprov" } bctls-jdk18on = { module = "org.bouncycastle:bctls-jdk18on", version.ref = "bouncycastle" } commons-logging = { module = "commons-logging:commons-logging", version.ref = "commons-logging" } commons-beanutils = { module = "commons-beanutils:commons-beanutils", version.ref = "commons-beanutils" } From 69ab078131bf1de22bc0f6692b0a7fb84901345f Mon Sep 17 00:00:00 2001 From: Lari Hotari Date: Tue, 18 Aug 2026 14:45:03 +0300 Subject: [PATCH 2/2] [improve][build] Record the BouncyCastle FIPS certificate mapping in the version catalog The FIPS 140-3 cryptographic boundary for BC-FJA is the bc-fips jar file name: the security policy for CMVP certificate #4943 names bc-fips-2.1.1.jar, and #4743 names bc-fips-2.0.0.jar. Exactly one published jar per line is therefore the validated module, and BouncyCastle ships security fixes only in the later "Provider (patched)" releases, certifying them afterwards. The consequence, which is easy to get wrong when bumping these versions, is that no certified bc-fips jar is free of known CVEs: 2.1.1 has 13 and 2.0.0 has 11, two CVSS 9.3 in each. Record the mapping and that reasoning next to the versions so the trade-off does not have to be re-derived. Also note that bc-fips is test-only in this build. No version changes. Assisted-by: Claude Code (Opus 5) --- gradle/libs.versions.toml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 9fca42a4a0af6..37e7e420360bc 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -59,6 +59,19 @@ bouncycastle = "1.85" # bcprov is versioned separately: BouncyCastle shipped a provider-only patch release (1.85.2) # that was not published for bcpkix-jdk18on or bctls-jdk18on, which remain at 1.85 bouncycastle-bcprov = "1.85.2" +# BouncyCastle FIPS. Test-only in this build (tests/pulsar-client-test-bcfips): the server distribution +# excludes bc-fips and ships the non-FIPS provider, so a FIPS deployment assembles its own classpath. +# +# The FIPS 140-3 cryptographic boundary is the bc-fips jar *file name*, so exactly one version per line +# is the validated module — the security policies name bc-fips-2.1.1.jar and bc-fips-2.0.0.jar: +# #4943 BC-FJA 2.1.1 active, "Interim Validation", sunset 2027-01-16 https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4943 +# #4743 BC-FJA 2.0.0 active, sunset 2029-07-28 https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4743 +# BouncyCastle ships security fixes only in later releases of a line — labelled "Provider (patched)" on +# its download page — and submits them for certification afterwards, so no certified jar is CVE-free: +# 2.1.1 has 13 known CVEs and 2.0.0 has 11, two CVSS 9.3 in each (CVE-2026-8763, CVE-2026-58062). +# The versions below are the vendor's minimum fixed versions for the 2.1.x line and have none. They are +# no worse than the previous 2.0.1/2.0.11/2.0.6 pins on certification — those were not certified either. +# bcpkix-fips and bcutil-fips are outside the certified boundary. bouncycastle-bcpkix-fips = "2.1.12" bouncycastle-bcutil-fips = "2.1.7" bouncycastle-bc-fips = "2.1.3"