orangeCatDeveloper opened a new pull request, #4312:
URL: https://github.com/apache/hertzbeat/pull/4312
## What's changed?
Fixes #3540: the project ships BouncyCastle from the abandoned `jdk15on`
line (`bcpkix-jdk15on:1.68`, 2020) — it no longer receives releases, so its
known CVEs will never be patched, and every dependency scan flags it. Two entry
points: a direct dependency in `hertzbeat-collector-basic`, and a transitive
one from the vesoft NebulaGraph client.
The replacement is the maintained `jdk18on` line at the current release,
managed as one root-pom property:
```xml
<bouncycastle.version>1.85</bouncycastle.version>
```
`hertzbeat-collector-basic` swaps its direct dependency;
`hertzbeat-collector-nebulagraph` excludes the jdk15on jars from the vesoft
client and supplies jdk18on explicitly — the two lines share package and class
names, so the vesoft client (compiled against jdk15on) links against jdk18on
unchanged. The `material/licenses` manifests and the six per-artifact license
files are renamed/updated to match what the release actually ships.
Dependency tree, before → after:
```
org.bouncycastle:bcpkix-jdk15on:jar:1.68 →
org.bouncycastle:bcpkix-jdk18on:jar:1.85
\-
org.bouncycastle:bcutil-jdk18on:jar:1.85
\-
org.bouncycastle:bcprov-jdk18on:jar:1.85
```
`jdk15on` no longer appears anywhere in the reactor, and the docker image
lib/ carries only the three jdk18on jars.
Every code path that consumes BC was exercised against 1.85, not just
compiled:
- **MQTT client-cert auth** — new `MqttSslFactoryTest` parses generated
PKCS#1 and PKCS#8 private keys through the production `getMslSocketFactory`
path.
- **NebulaGraph SSL** — new `VesoftSslBouncyCastleSmokeTest` feeds a
BC-generated certificate through the vesoft client's own `SslUtil`, proving the
jdk15on-compiled client runs on jdk18on.
- **SSH private-key login** — `SshHelper.getConnectSession` with a PEM RSA
key completed a real handshake (`AUTHED`) against OpenSSH 9.6.
Full test suites of all modules with BC on the classpath (collector-common,
collector-basic, collector-nebulagraph, collector-collector, push) pass; the
only failures encountered were OceanBase/MySQL testcontainers startup timeouts
that reproduce identically on master.
## Checklist
- [x] I have read the [Contributing
Guide](https://hertzbeat.apache.org/docs/community/code_style_and_quality_guide)
- [x] I have written the necessary doc or comment.
- [x] I have added the necessary unit tests and all cases have passed.
## Add or update API
- [ ] I have added the necessary [e2e
tests](https://github.com/apache/hertzbeat/tree/master/e2e) and all cases have
passed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
