<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/REC-html40/loose.dtd">
<html lang="en">
<head>
<meta content="text/html; charset=US-ASCII" http-equiv="Content-Type">
<title>
GitLab
</title>
<style>img {
max-width: 100%; height: auto;
}
</style>
</head>
<body>
<div class="content">
<h3>
Timo Aaltonen pushed to branch master
at <a href="https://salsa.debian.org/freeipa-team/jss">FreeIPA packaging / jss</a>
</h3>
<h4>
Commits:
</h4>
<ul>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/dba06409ab0fe8e86015240241a183a4c7c401d9">dba06409</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-08-20T09:59:54-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add Fedora 33 to CI
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/731650bae5ad919c0ea9e0dcf34281d613ab5171">731650ba</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-08-20T09:59:54-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Always attempt to pull a newer base image
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/33eafccaf6b8bc685b83952cc171ebc9393bdbaf">33eafcca</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-08-20T09:59:54-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Switch to Fedora registry for Fedora-based images
This is updated more frequently than Dockerhub, which `docker` in CI
will default to.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/1f20372253bcaef50803dc3dc1193f7c7a86cb9e">1f203722</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-08-31T17:29:34-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add NSS stubs for BadCertHandler
The JDK's SSL interfaces under javax.net.ssl do not provide a way for
the SSLSocket/SSLEngine instance to validate hostname during the
handshake. Instead, the accepted way of doing hostname verification
(using a HostnameVerifier) is after the handshake is completed. This
causes problems with NSS, because they assume the hostname is available
for validation at handshake time.
In order to support this use case, when the hostname is `null` on a
client SSL socket, we will attach using SSL_BadCertHook and give the
JSSEngine a chance to bypass this value.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/a7b43ee2ec17f302ec3a0d942f5f4e73ed1659a3">a7b43ee2</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-08-31T17:29:34-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add SSLErrors with SSL_ERROR_BAD_CERT_DOMAIN
This is the only SSLError we wish to allow through in regular JSSEngine
client operations.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/fe75335bcf8ae6ad77a2e9cf597eea42e138dd2f">fe75335b</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-08-31T17:29:34-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Bypass SSL_ERRORS_BAD_CERT_DOMAIN for JDK
When JSSEngine is used via the provider interface, most callers won't be
aware that they're using JSSEngine. As a side effect, they won't be
using JSSEngine's setHostname() to validate the server's SSL
certificate. This means NSS has no knowledge of the hostname, throwing
an error like:
Caused by: javax.net.ssl.SSLHandshakeException: Error duing SSL.ForceHandshake() :: SSL_ERROR_BAD_CERT_DOMAIN (-12276)
at org.mozilla.jss.ssl.javax.JSSEngineReferenceImpl.updateHandshakeState(JSSEngineReferenceImpl.java:856)
at org.mozilla.jss.ssl.javax.JSSEngineReferenceImpl.unwrap(JSSEngineReferenceImpl.java:1037)
at org.mozilla.jss.ssl.javax.JSSSocketChannel.read(JSSSocketChannel.java:272)
We need to provide a mechanism to bypass this by default for these
connections, in order to stay compatible with the JCA. This approach was
suggested by Bob Relyea.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/d0c8b2453dff73d412ba7a4ffa274c16ea57a415">d0c8b245</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-02T10:28:51-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Disable ENABLE_FALLBACK_SCSV for JCA compatibility
While ENABLE_FALLBACK_SCSV is present in most browsers, it isn't
generally suitable for use in a library by default because connected
applications might use different TLS versions than this library. This
will result in breakage when downgrading TLS versions would usually be
fine (such as TLSv1.2 from TLSv1.3). Additionally, JCA providers don't
set this option by default.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/0857629c266b1f62ae9f8afab85e0b7d09651145">0857629c</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-02T10:28:51-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add Post-Handshake Auth to legacy SSLSocket
When TLSv1.3 was introduced into the legacy SSLSocket prior to the
introduction of JSSEngine, we didn't add support for PHA. This only
requires adding a single option, SSL_ENABLE_POST_HANDSHAKE_AUTH, and
allowing the user to control whether or not it is enabled. Enabling this
option brings compatibility with TLSv1.2's rehandshakes for identifying
the user after the initial request. Because Tomcat uses this upgrade
path (for an application with mixed authenticated and non-authenticated
endpoints), we need to support it in SSLSocket.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/419a1cd7c630900f1688446f848a253550428246">419a1cd7</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-02T20:40:50-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix JNI function misname
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/b2a334466148ccfe13c2fe16a25fa19178756228">b2a33446</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-10T16:17:46-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">When hostname is missing, set BAD_CERT_DOMAIN
This fixes a bug with the BadCertHook that we recently introduced: when
no hostname is set, NSS sets SSL_ERRORS_BAD_CERT_DOMAIN, but our custom
callback didn't. This meant it would pass the last seen error back up to
the caller, even though we meant to set this instead.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/25ca993c7dbeb40738bfeaa3c10e92bcd3ad1172">25ca993c</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-10T16:17:46-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add additional inline documentation to JSSEngine
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/37543cc76e41e40f2d5df5fc6b1051356907f62f">37543cc7</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-10T16:17:46-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add CryptoManager.isInitialized()
This prevents Java from thinking we're trying to recursively load the
JSSProvider. We kinda are, but we just really need to trigger it to load
in more instances.
In particular, in JSSProvider, we need to check if CryptoManager is
already initialized, and if not, initialize it. We used
CryptoManager.getInstance() for this, which in turn tries to load the
provider if it isn't already loaded. This resulted in a recursive
initialization. By using CryptoManager.isInitialized(), we can avoid the
call to CryptoManager.getInstance() and avoid this recursion.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/f10c7b96ffd20e17ab62ce4e200acb8c56b62b6b">f10c7b96</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-10T16:17:46-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add SNI to all socket connections
One limitation of NSS's SSL APIs is that client sockets cannot indicate
SNI information except via SSL_SetURL(). The downside with this approach
is that the same hostname is also used for certificate validation. In
particular, Java doesn't expose the hostname for certificate validation,
but only exposes one hostname in the SSLEngine constructor. This means
we shouldn't usually use this hostname for certificate validation, but
only for SNI.
However, some servers require SNI in order for the connection to
succeed. One example at the time of writing is google.com. By using
SSL_SetURL, we both validate the certificate and provide SNI, which is
sufficient in most instances. However, in the event the hostname is
incorrect for certificate validation, a BAD_CERT_DOMAIN error will still
raise, triggering our other checks, and return control back to Java's
hostname validation logic.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/1244bb0c65f4fb0cbf755ac8ffdabb595aad6a28">1244bb0c</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-10T16:17:46-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix parameters on unwrap() buffer copy
When reading data from NSS during unwrap(), we get the result back as a
single byte array. However, the caller already has separate ByteBuffer
instances that we need to put data into. Because the loop incremented
the index again, we returned one extra byte. This resulted in the
JSSEngine caller thinking there was one more byte of data, usually a
NULL byte. When multiple HTTPS requests were issued on a single TLS
connection, this resulted in the caller getting a single NULL byte
between requests, causing HTTP parsing libraries to throw an
exception.
Fixing the array bounds and returning the correct size fixes the
problem.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/05075c6d32744c33bc4b0c7df2f140e2b5ced8a9">05075c6d</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-10T16:17:46-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Test bytes produced/consumed in SSLEngine
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/db5eaaf6d4df6a8b000a8ee1a9bb6208a78e1daf">db5eaaf6</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-10T17:22:58-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Add documentation about CryptoManager/JSSProvider
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/2e693d52eddd3d1b388a74cc00632b64d6a71f59">2e693d52</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-17T14:03:42-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Port from Apache Commons Lang 2 -> 3
Credits: Fabio "decathorpe" Valentini
Resolves: #621
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/72a75fba9aa7c88ea70c0a8f01a5c0ab9535fc74">72a75fba</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-18T10:15:12-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Bump JSS version to v4.8.0 alpha 1
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/6c40ee991a1d2efa218cb8e35161fb88570b3157">6c40ee99</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-09-18T16:41:14-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Finish releasing slots after use
Slots in NSS are reference counted; it is important to release our copy
of the reference when we're done using it. This fixes various instances
of slots either not being released or being released in the wrong order.
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/7207f9dacd2e7a949638cef3860836cf193d901e">7207f9da</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-10-05T10:27:00-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Move issue reports from Pagure to GitHub
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/eefb1d9866a6d82bb057f9647a158c01e1299280">eefb1d98</a></strong>
<div>
<span>by Endi S. Dewata</span>
<i>at 2020-10-06T16:01:47-05:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Update .classpath
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/3fa5c8cda7c6a32edc5b1e80627093126cdbffba">3fa5c8cd</a></strong>
<div>
<span>by Fraser Tweedale</span>
<i>at 2020-10-12T09:25:57-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Fix missing OIDMap mappings for X.509 extensions
I was getting a very strange error in JSSTrustManager certificate
validation. The leaf certificate was (wrongly) being rejected for
not having the id-kp-serverAuth EKU.
I traced the error to X509CertImpl.getExtensionValue(); in
particular its catch block. Upon exception it discards the
exception and returns null. (This is not unreasonable when e.g. the
extension data cannot be parsed). I added some debug logging. The
exception thrown was:
java.security.cert.CertificateParsingException: Invalid root of
attribute name, expected [x509], received [ExtendedKeyUsageExtension]
at ...X509CertImpl.get(X509CertImpl.java:499)
at ...X509CertImpl.getExtensionValue(X509CertImpl.java:1014)
>From here I traced it to the OIDMap and the String names. Whereas
most extension names in the OIDMap had a prefix of
"x509.info.extensions.", three did not, including
ExtendedKeyUsageExtension. getExtensionValue() looks up the name in
the OIDMap by OID, then uses it to index into internal structures to
return the datum suggested by the OID. Reinstating the prefix in
the OIDMap resolved the issue.
Apart from EKU the two other affected extensions are Subject
Directory Attributes and Certificate Policies. Why the prefixes
were omitted for these three extensions is lost in time. This code
was moved from Dogtag to JSS relatively recently, but the code was
like this in the first commit in Dogtag's repo, from 2008.
I believe there is a low likelihood of regression from this change.
As far as I can tell, the only classes that use the result of
OIDMap.getName() in a logical process are X509CertImpl and friends
X509CRLImpl and RevokedCertImpl. It is also used in ExtPrettyPrint
but only for pretty-printing.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/ac245c43154a82753a39a2030228768ef6c60158">ac245c43</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-10-15T12:57:10-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Update minimum NSS version in README
Resolves: #645 reported by @cosarara
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/9ece51b7448f460a29060532a871a07ff446e982">9ece51b7</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-10-27T10:23:01-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Log exceptions when libjss4.so failed to load
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/3e489fe3c2e4f53d3d23d18a96a030a0fb7a2e82">3e489fe3</a></strong>
<div>
<span>by Fraser Tweedale</span>
<i>at 2020-10-28T09:56:50-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">JSSSocketChannel.read: deliver all data from buffer fd
JSSSocketChannel.read() returns 0 when the underlying socket does
not yield any new data. But in the case of small output buffers,
earlier invocations of read() may result in more decrypted data
sitting in the unwrapped side of the j_buffer, never to be
delievered to the application.
To resolve this issue, continue on to unwrap() even when the
underlying socket does not yield new data.
However, only do this after the handshake has been completed.
Empirically, calling unwrap() at early stages of the handshake with
empty buffers breaks /something/, causing no data to ever be read
from the socket. (I do not understand the exact cause.)
As part of this change, also refactor how the remote read is
handled. The choice of which channel to read and handling of
blocking channels is now abstracted behind the remoteRead() method,
which subsumes boundRead().
This commit also addresses a subtle bug. If the readBuffer contains
more data than the capacity of the j_buffer to which it is written,
and if the dst buffer(s) get filled, then JSSSocketChannel.read()
can terminate with leftover data in readBuffer. Upon the next
invocation of read(), readBuffer.clear() is called, discarding those
data. This commit modifies read() to ensure that leftover data in
readBuffer are compacted and preserved.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/c2b1d83f1b49e9ecddf8751086ce3e4a2ba29863">c2b1d83f</a></strong>
<div>
<span>by Fraser Tweedale</span>
<i>at 2020-10-28T09:56:50-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">PR.Read: return data when end of stream reached
Commit 424d55639c51bca18110dcff51fb5df2e2e35a41 introduced a
workaround in PR.Read for a bug in NSS' PR_Read that occurs on some
platforms. The bug can cause PR_Read to return a smaller amount
than requested, even when more data is available. The workaround is
to loop until we have either read the requested amount, or we
encounter PR_WOULD_BLOCK_ERROR.
Unfortunatley there is a bug in the workaround: the end of stream
case was not considered. In this case, the first PR_Read reads less
than the requested amount, and we loop. The next PR_Read returns 0,
but the "not an error" condition
PR_GetError() == PR_WOULD_BLOCK_ERROR && read_amount > 0
does not admit the end of stream case (PR_GetError() == 0). As a
consequence, PR.Read returns an empty byte[] and the data from the
final read before end of stream are lost.
To resolve this issue, break the loop when PR_Read returns <= 0 but
PR_GetError() returns 0.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/65c27519abd45458d9aefc6baf3bf45fc274a454">65c27519</a></strong>
<div>
<span>by Fraser Tweedale</span>
<i>at 2020-10-28T09:56:50-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">JSSSocketChannel.read: record when input is closed
When reading the socket channel, no special action is taken when the
SSLEngine.unwrap() returns an SSLEngineResult with status CLOSED.
As a consequence, JSSSocketChannel.read() never returns -1, even
after the sender has closed their send end of the socket and the TLS
close_notify alert has been processed. Programs that rely on the
read() returning -1 to indicate end of data will loop forever.
To resolve, call shutdownInput() when unwrap() indicates that the
read side of the socket is closed. This idempotent action causes
subsequent invocations of read() to return -1, as required by the
SocketChannel contract.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/9502efb6a8f97f3dc5c4b9830c30b95f0ca760d6">9502efb6</a></strong>
<div>
<span>by Alexander Scheel</span>
<i>at 2020-10-28T15:46:06-04:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Release JSS v4.8.0
This version of JSS has a few minor improvements over v4.7.x series:
- Porting from Apache Commons Lang 2 to 3
- A few memory fixes
- Two contributions from Fraser Tweedale:
- Fix missing OIDMap mappings for X.509 extensions
- JSSSocketChannel.read(): deliver all data from buffer fd
Thanks to everyone who contributed to this release!
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/1b24a4e795a8477e6144d439365dd8b28e1f6a4d">1b24a4e7</a></strong>
<div>
<span>by Timo Aaltonen</span>
<i>at 2020-10-31T19:03:57+02:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Merge commit 'a715520a0dc7d4a' into m
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/cc45229da41c23f17832f5e0b1a0e3d533d68007">cc45229d</a></strong>
<div>
<span>by Timo Aaltonen</span>
<i>at 2020-10-31T19:04:02+02:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">Merge branch 'master' into m
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/7b80062224a344679692854a9af93b8a64e2bb52">7b800622</a></strong>
<div>
<span>by Timo Aaltonen</span>
<i>at 2020-10-31T19:04:39+02:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">bump the version
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/74ec5d76b4addcca5c4545fe82db6c6ff20afb55">74ec5d76</a></strong>
<div>
<span>by Timo Aaltonen</span>
<i>at 2020-10-31T19:10:04+02:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">control: Build using libcommons-lang3-java.
</pre>
</li>
<li>
<strong><a href="https://salsa.debian.org/freeipa-team/jss/-/commit/bc4641ad721efe0dd6fec2c12f43bc801fbd7087">bc4641ad</a></strong>
<div>
<span>by Timo Aaltonen</span>
<i>at 2020-10-31T19:16:39+02:00</i>
</div>
<pre class="commit-message" style="white-space: pre-wrap; margin: 0;">releasing package jss version 4.8.0-1
</pre>
</li>
</ul>
<h4>30 changed files:</h4>
<ul>
<li class="file-stats">
<a href="#354079a72b91a4280407c16a36f47d1986fd85a5">
.classpath
</a>
</li>
<li class="file-stats">
<a href="#5a8c90f0f1247e55f28895fb8ea7046d8987974f">
.github/workflows/required.yml
</a>
</li>
<li class="file-stats">
<a href="#8ec9a00bfd09b3190ac6b22251dbb1aa95a0579d">
README.md
</a>
</li>
<li class="file-stats">
<a href="#9f3af9fef0e3976107ab469d0eb1c9684c9aa796">
cmake/JSSConfig.cmake
</a>
</li>
<li class="file-stats">
<a href="#9c96da0e9f91d7d8937b69b524702c106258f0d1">
debian/changelog
</a>
</li>
<li class="file-stats">
<a href="#58ef006ab62b83b4bec5d81fe5b32c3b4c2d1cc2">
debian/control
</a>
</li>
<li class="file-stats">
<a href="#169bd8d967f61642ae102ae69d7070bcb2d86740">
docs/contributing.md
</a>
</li>
<li class="file-stats">
<a href="#e47efe31dd7936771e4108992a22110f0b1eeba4">
<span class="new-file">
+
docs/usage/cryptomanager.md
</span>
</a>
</li>
<li class="file-stats">
<a href="#063bf4b6263fbc45f86d361246396c742b514a97">
jss.spec
</a>
</li>
<li class="file-stats">
<a href="#6722cbd0f8d28e4aaa6caeeef3d82a2704da7b07">
org/mozilla/jss/CryptoManager.java
</a>
</li>
<li class="file-stats">
<a href="#f25327ca669e703a8591fc937649e0fef06630d8">
org/mozilla/jss/JSSLoader.java
</a>
</li>
<li class="file-stats">
<a href="#a388a7294ace038d7d86a8341dbb6c6028e33fc8">
org/mozilla/jss/crypto/KBKDF.c
</a>
</li>
<li class="file-stats">
<a href="#ef6201adee9f74be1d8432600633055d5a03960e">
org/mozilla/jss/netscape/security/pkcs/PKCS12Util.java
</a>
</li>
<li class="file-stats">
<a href="#7f64eb084ad68cb0a2628471897147ee58e4eea2">
org/mozilla/jss/netscape/security/util/Cert.java
</a>
</li>
<li class="file-stats">
<a href="#2abd82a58a90e01f61fd6dfdd6419f3b0f601f80">
org/mozilla/jss/netscape/security/x509/OIDMap.java
</a>
</li>
<li class="file-stats">
<a href="#9c105a8e3c83d504b3116dcfd127ee8e124c5d91">
org/mozilla/jss/netscape/security/x509/RevocationReasonAdapter.java
</a>
</li>
<li class="file-stats">
<a href="#28cff736485d163f81b08c15eddb6d10328ac1b9">
org/mozilla/jss/nss/PR.c
</a>
</li>
<li class="file-stats">
<a href="#c26e371943aae6665a77d0b3c751fef8f2a278e6">
org/mozilla/jss/pkcs11/PK11PrivKey.c
</a>
</li>
<li class="file-stats">
<a href="#eceecfd36e29cf804ef9c73a4ef3ef35993908e3">
org/mozilla/jss/pkcs11/PK11PubKey.c
</a>
</li>
<li class="file-stats">
<a href="#8087549ae32b1b6854a61d29ab789a2a95d67a4f">
org/mozilla/jss/pkcs11/PK11Token.c
</a>
</li>
<li class="file-stats">
<a href="#aa5e530e86918f856434b5dcc84ac08dd55d564c">
org/mozilla/jss/provider/java/security/JSSKeyStoreSpi.java
</a>
</li>
<li class="file-stats">
<a href="#73f48b9229408209c35e8a5d812144dfc95faf87">
org/mozilla/jss/provider/javax/crypto/JSSTrustManager.java
</a>
</li>
<li class="file-stats">
<a href="#56c89d32690c5677d15683674b5e24bcacf39116">
org/mozilla/jss/ssl/callbacks.c
</a>
</li>
<li class="file-stats">
<a href="#e387bf4dbd3d55d0c633cd5600e67f1a2c208b3c">
org/mozilla/jss/ssl/javax/JSSEngine.java
</a>
</li>
<li class="file-stats">
<a href="#1eb17f3deb635893bb5d47983d33aacdd80fb95f">
org/mozilla/jss/ssl/javax/JSSEngineReferenceImpl.java
</a>
</li>
<li class="file-stats">
<a href="#c5716462693be4e3a4ed21ff0a04297870edf8fb">
org/mozilla/jss/ssl/javax/JSSSocketChannel.java
</a>
</li>
<li class="file-stats">
<a href="#784a7f48cf6f035e6f987cc011ca26fc6022292d">
org/mozilla/jss/tests/TestSSLEngine.java
</a>
</li>
<li class="file-stats">
<a href="#3a8fd329b93e7075896ed6748351270cd6fbec1d">
org/mozilla/jss/tests/UTF8ConverterTest.java
</a>
</li>
<li class="file-stats">
<a href="#3e16cce484ab77f4fb7cd0d8d58aec763574e60f">
tools/Dockerfiles/debian_jdk11
</a>
</li>
<li class="file-stats">
<a href="#1d2851a11dacba9564ab9d69b3f76d94b3bb5283">
tools/Dockerfiles/fedora_27
</a>
</li>
</ul>
<h5>The diff was not included because it is too large.</h5>
</div>
<div class="footer" style="margin-top: 10px;">
<p style="font-size: small; color: #666;">
—
<br>
<a href="https://salsa.debian.org/freeipa-team/jss/-/compare/687fd3ab4f0150d992955280c7d863c7b7770054...bc4641ad721efe0dd6fec2c12f43bc801fbd7087">View it on GitLab</a>.
<br>
You're receiving this email because of your account on salsa.debian.org.
If you'd like to receive fewer emails, you can
adjust your notification settings.
</p>
</div>
</body>
</html>