diff --git a/README.md b/README.md
index 272bab3b4..7157e18a5 100644
--- a/README.md
+++ b/README.md
@@ -127,8 +127,9 @@ platform. We publish artifacts to Maven Central for the following platforms:
Classifier | OS | Architecture
-----------| ------- | ---------------- |
linux-x86_64 | Linux | x86_64 (64-bit)
+linux-aarch_64 | Linux | aarch_64 (64-bit)
osx-x86_64 | Mac | x86_64 (64-bit)
-windows-x86 | Windows | x86 (32-bit)
+osx-aarch_64 | Mac | aarch_64 (64-bit)
windows-x86_64 | Windows | x86_64 (64-bit)
#### Maven
@@ -149,7 +150,7 @@ Use the [os-maven-plugin](https://github.com/trustin/os-maven-plugin) to add the
org.conscrypt
conscrypt-openjdk
- 2.5.2
+ 2.6.0
${os.detected.classifier}
```
@@ -172,7 +173,7 @@ buildscript {
apply plugin: "com.google.osdetector"
dependencies {
- compile 'org.conscrypt:conscrypt-openjdk:2.5.2:' + osdetector.classifier
+ compile 'org.conscrypt:conscrypt-openjdk:2.6.0:' + osdetector.classifier
}
```
@@ -190,14 +191,14 @@ To depend on the uber jar, simply use the `conscrypt-openjdk-uber` artifacts.
org.conscrypt
conscrypt-openjdk-uber
- 2.5.2
+ 2.6.0
```
##### Gradle
```gradle
dependencies {
- compile 'org.conscrypt:conscrypt-openjdk-uber:2.5.2'
+ compile 'org.conscrypt:conscrypt-openjdk-uber:2.6.0'
}
```
@@ -210,7 +211,7 @@ arm64-v8a.
```gradle
dependencies {
- implementation 'org.conscrypt:conscrypt-android:2.5.2'
+ implementation 'org.conscrypt:conscrypt-android:2.6.0'
}
```
diff --git a/common/src/jni/main/cpp/conscrypt/native_crypto.cc b/common/src/jni/main/cpp/conscrypt/native_crypto.cc
index ef9256df7..9f8bf4ee3 100644
--- a/common/src/jni/main/cpp/conscrypt/native_crypto.cc
+++ b/common/src/jni/main/cpp/conscrypt/native_crypto.cc
@@ -3850,12 +3850,12 @@ static jbyteArray NativeCrypto_EVP_DigestSign(JNIEnv* env, jclass, jobject evpMd
jint in_offset = inOffset;
jint in_size = inLength;
- jbyte* array_elements = env->GetByteArrayElements(inJavaBytes, nullptr);
- if (array_elements == nullptr) {
+ ScopedByteArrayRO array_elements(env, inJavaBytes);
+ if (array_elements.get() == nullptr) {
conscrypt::jniutil::throwOutOfMemory(env, "Unable to obtain elements of inBytes");
return nullptr;
}
- const unsigned char* buf = reinterpret_cast(array_elements);
+ const unsigned char* buf = reinterpret_cast(array_elements.get());
const unsigned char* inStart = buf + in_offset;
size_t inLen = static_cast(in_size);
diff --git a/common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java b/common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java
index 7bf176643..521266a28 100644
--- a/common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java
+++ b/common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java
@@ -162,6 +162,8 @@ private static List getKeySizes(String algorithm) throws Exception {
putKeySize("ML-DSA-87", -1);
putKeySize("SLH-DSA-SHA2-128S", -1);
putKeySize("XWING", -1);
+ putKeySize("MLDSA44-Ed25519-SHA512", -1);
+ putKeySize("MLDSA65-Ed25519-SHA512", -1);
}
/** Elliptic Curve Crypto named curves that should be supported. */
@@ -284,8 +286,8 @@ private void test_Key(KeyPairGenerator kpg, Key k) throws Exception {
// serializable, so just skip them.
return;
}
- if (expectedAlgorithm.equals("ML-DSA")) {
- // ML-DSA keys are not yet serializable, so just skip them.
+ if (expectedAlgorithm.equals("ML-DSA") || expectedAlgorithm.startsWith("MLDSA")) {
+ // ML-DSA and Composite ML-DSA keys are not yet serializable, so just skip them.
return;
}
if (expectedAlgorithm.equals("ML-KEM")) {
diff --git a/common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java b/common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java
index 2bcb67c9a..f161b5073 100644
--- a/common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java
+++ b/common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java
@@ -1043,14 +1043,19 @@ public void handshake_p256IsSupportedByDefault() throws Exception {
s.get();
c.get();
// By default, BoringSSL uses X25519, P-256, and P-384.
+ // On newer versions of BoringSSL, X25519MLKEM768 is also a default.
if (sslParametersSupportsNamedGroups()) {
// If the client requests P-256, it will be chosen.
assertEquals("P-256", getCurveName(client));
assertEquals("P-256", getCurveName(server));
} else {
- // Otherwise, X25519 gets priority.
- assertEquals("X25519", getCurveName(client));
- assertEquals("X25519", getCurveName(server));
+ // Otherwise, X25519 or X25519MLKEM768 gets priority.
+ String clientCurve = getCurveName(client);
+ String serverCurve = getCurveName(server);
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve,
+ clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768"));
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve,
+ serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768"));
}
client.close();
server.close();
@@ -1078,14 +1083,19 @@ public void handshake_p384IsSupportedByDefault() throws Exception {
s.get();
c.get();
// By default, BoringSSL uses X25519, P-256, and P-384.
+ // On newer versions of BoringSSL, X25519MLKEM768 is also a default.
if (sslParametersSupportsNamedGroups()) {
// If the client requests P-384, it will be chosen.
assertEquals("P-384", getCurveName(client));
assertEquals("P-384", getCurveName(server));
} else {
- // Otherwise, X25519 gets priority.
- assertEquals("X25519", getCurveName(client));
- assertEquals("X25519", getCurveName(server));
+ // Otherwise, X25519 or X25519MLKEM768 gets priority.
+ String clientCurve = getCurveName(client);
+ String serverCurve = getCurveName(server);
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve,
+ clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768"));
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve,
+ serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768"));
}
client.close();
server.close();
@@ -1120,9 +1130,13 @@ public void handshake_setsNamedGroups_usesFirstServerNamedGroupThatClientSupport
assertEquals("P-384", getCurveName(client));
assertEquals("P-384", getCurveName(server));
} else {
- // The defaults are used, and X25519 gets priority.
- assertEquals("X25519", getCurveName(client));
- assertEquals("X25519", getCurveName(server));
+ // The defaults are used, and X25519 or X25519MLKEM768 gets priority.
+ String clientCurve = getCurveName(client);
+ String serverCurve = getCurveName(server);
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve,
+ clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768"));
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve,
+ serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768"));
}
client.close();
server.close();
@@ -1179,9 +1193,13 @@ public void handshake_setsNamedGroupsBeforeAccept_usesFirstServerNamedGroupThatC
assertEquals("P-384", getCurveName(client));
assertEquals("P-384", getCurveName(server));
} else {
- // The defaults are used, and X25519 gets priority.
- assertEquals("X25519", getCurveName(client));
- assertEquals("X25519", getCurveName(server));
+ // The defaults are used, X25519 or X25519MLKEM768 gets priority.
+ String clientCurve = getCurveName(client);
+ String serverCurve = getCurveName(server);
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve,
+ clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768"));
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve,
+ serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768"));
}
client.close();
server.close();
@@ -1214,9 +1232,13 @@ public void handshake_withX25519MLKEM768_works() throws Exception {
assertEquals("X25519MLKEM768", getCurveName(client));
assertEquals("X25519MLKEM768", getCurveName(server));
} else {
- // The defaults are used, and X25519 gets priority.
- assertEquals("X25519", getCurveName(client));
- assertEquals("X25519", getCurveName(server));
+ // The defaults are used, and X25519 or X25519MLKEM768 gets priority.
+ String clientCurve = getCurveName(client);
+ String serverCurve = getCurveName(server);
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve,
+ clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768"));
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve,
+ serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768"));
}
client.close();
server.close();
@@ -1309,9 +1331,13 @@ public void handshake_namedGroupsDontIntersect_throwsException() throws Exceptio
} else {
s.get();
c.get();
- // The defaults are used, and X25519 gets priority.
- assertEquals("X25519", getCurveName(client));
- assertEquals("X25519", getCurveName(server));
+ // The defaults are used, and X25519 or X25519MLKEM768 gets priority.
+ String clientCurve = getCurveName(client);
+ String serverCurve = getCurveName(server);
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve,
+ clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768"));
+ assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve,
+ serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768"));
}
client.close();
server.close();
diff --git a/openjdk-uber/build.gradle b/openjdk-uber/build.gradle
index 2d9e29839..c8b527007 100644
--- a/openjdk-uber/build.gradle
+++ b/openjdk-uber/build.gradle
@@ -113,6 +113,7 @@ if (buildUberJar) {
attributes ('BoringSSL-Version': boringSslVersion,
'Automatic-Module-Name': 'org.conscrypt',
'Bundle-SymbolicName': 'org.conscrypt',
+ 'Import-Package': '!android.util,*',
'-exportcontents': 'org.conscrypt.*')
}
diff --git a/openjdk/build.gradle b/openjdk/build.gradle
index 58332623c..d0a7aded8 100644
--- a/openjdk/build.gradle
+++ b/openjdk/build.gradle
@@ -278,6 +278,7 @@ jar.manifest {
attributes ('BoringSSL-Version' : boringSslVersion,
'Automatic-Module-Name' : 'org.conscrypt',
'Bundle-SymbolicName': 'org.conscrypt',
+ 'Import-Package': '!android.util,*',
'-exportcontents': 'org.conscrypt.*')
}