Re: RFR: 8320362: Load anchor certificates from Keychain keystore [v3]

2024-01-25 Thread Alexey Bakhtin
On Wed, 24 Jan 2024 16:04:03 GMT, Weijun Wang wrote: > Is it possible to reuse some some lines from `addCertificatesToKeystore`? > > BTW, I reviewed the CSR. Hi @wangweij, Thank you a lot for PR and CSR review. I have updated PR with review findings and refactored addCertificatesToKeystore/add

Re: RFR: 8320362: Load anchor certificates from Keychain keystore [v4]

2024-01-25 Thread Alexey Bakhtin
> Please review the proposed fix. > > The patch loads system root certificates from the MacOS Keychain with > TrustSettings. > It allows to build a trusted certificate path using the MacOS Keychain store > only. Alexey Bakhtin has updated the pull request incrementally with one additional comm

Re: RFR: 8320362: Load anchor certificates from Keychain keystore [v3]

2024-01-25 Thread Alexey Bakhtin
On Wed, 24 Jan 2024 15:41:11 GMT, Weijun Wang wrote: >> Alexey Bakhtin has updated the pull request incrementally with one >> additional commit since the last revision: >> >> Add KeychainStore-ROOT keystore for root certificates > > src/java.base/macosx/classes/apple/security/AppleProvider.ja

Re: [External] : Re: PEM API github repo

2024-01-25 Thread Anthony Scarpino
On 1/25/24 9:20 AM, Daniel Jeliński wrote: Hi Tony, Thanks for the links! The API looks very promising. Out of curiosity, why aren't you using the Base64 MIME encoder/decoder? They are supposed to produce/remove the newline characters. I can look it over again. I had inconsistencies during

Re: RFR: 8313367: SunMSCAPI cannot read Local Computer certs w/o Windows elevation

2024-01-25 Thread rebarbora-mckvak
On Thu, 16 Nov 2023 12:06:26 GMT, rebarbora-mckvak wrote: > This fixes the defect described at https://bugs.openjdk.org/browse/JDK-8313367 > > If the process does not have write permissions, the store is opened as > read-only (instead of failing). > > Please note that permissions to use a cert

Re: PEM API github repo

2024-01-25 Thread Daniel Jeliński
Hi Tony, Thanks for the links! The API looks very promising. Out of curiosity, why aren't you using the Base64 MIME encoder/decoder? They are supposed to produce/remove the newline characters. The relationship between the byte[] and String data should be specified. Base64 explicitly specifies that

Re: RFR: 8324648: Avoid NoSuchMethodError when instantiating NativePRNG

2024-01-25 Thread Oli Gillespie
On Wed, 24 Jan 2024 19:50:55 GMT, Chen Liang wrote: > I see that the existing caller code has a check for `ctorParamClass`. Why > must we declare `SecureRandomParameters.class` as the `ctorParamClass` for > these 3 randoms instead of using `null`? >From [lookup >code](https://github.com/openj

Re: RFR: 8324646: Avoid Class.forName in SecureRandom constructor [v2]

2024-01-25 Thread Oli Gillespie
On Wed, 24 Jan 2024 20:09:12 GMT, Roger Riggs wrote: >> I don't disagree in principle but it was like this before the revert, and is >> still like this in 17. > > Is volatile really needed? And there is some performance penalty and in > practice the value will be the same even if recomputed. S

[jdk22] Integrated: 8319128: sun/security/pkcs11 tests fail on OL 7.9 aarch64

2024-01-25 Thread Goetz Lindenmaier
On Tue, 23 Jan 2024 10:21:42 GMT, Goetz Lindenmaier wrote: > I backport this to fix this issue in 22. We see it failing there in our CI. This pull request has now been integrated. Changeset: 57bc96e5 Author:Goetz Lindenmaier URL: https://git.openjdk.org/jdk22/commit/57bc96e5cdc6b30e