From 26aaa7db508db66419c7779e75b6879a641127a7 Mon Sep 17 00:00:00 2001 From: Miguel Aranda Date: Fri, 10 Jul 2026 10:49:04 +0000 Subject: [PATCH] Project import generated by Copybara. PiperOrigin-RevId: 945621565 --- README.md | 13 ++-- .../jni/main/cpp/conscrypt/native_crypto.cc | 6 +- .../java/security/KeyPairGeneratorTest.java | 6 +- .../javax/net/ssl/SSLSocketTest.java | 62 +++++++++++++------ openjdk-uber/build.gradle | 1 + openjdk/build.gradle | 1 + 6 files changed, 60 insertions(+), 29 deletions(-) diff --git a/README.md b/README.md index 272bab3b4..7157e18a5 100644 --- a/README.md +++ b/README.md @@ -127,8 +127,9 @@ platform. We publish artifacts to Maven Central for the following platforms: Classifier | OS | Architecture -----------| ------- | ---------------- | linux-x86_64 | Linux | x86_64 (64-bit) +linux-aarch_64 | Linux | aarch_64 (64-bit) osx-x86_64 | Mac | x86_64 (64-bit) -windows-x86 | Windows | x86 (32-bit) +osx-aarch_64 | Mac | aarch_64 (64-bit) windows-x86_64 | Windows | x86_64 (64-bit) #### Maven @@ -149,7 +150,7 @@ Use the [os-maven-plugin](https://github.com/trustin/os-maven-plugin) to add the org.conscrypt conscrypt-openjdk - 2.5.2 + 2.6.0 ${os.detected.classifier} ``` @@ -172,7 +173,7 @@ buildscript { apply plugin: "com.google.osdetector" dependencies { - compile 'org.conscrypt:conscrypt-openjdk:2.5.2:' + osdetector.classifier + compile 'org.conscrypt:conscrypt-openjdk:2.6.0:' + osdetector.classifier } ``` @@ -190,14 +191,14 @@ To depend on the uber jar, simply use the `conscrypt-openjdk-uber` artifacts. org.conscrypt conscrypt-openjdk-uber - 2.5.2 + 2.6.0 ``` ##### Gradle ```gradle dependencies { - compile 'org.conscrypt:conscrypt-openjdk-uber:2.5.2' + compile 'org.conscrypt:conscrypt-openjdk-uber:2.6.0' } ``` @@ -210,7 +211,7 @@ arm64-v8a. ```gradle dependencies { - implementation 'org.conscrypt:conscrypt-android:2.5.2' + implementation 'org.conscrypt:conscrypt-android:2.6.0' } ``` diff --git a/common/src/jni/main/cpp/conscrypt/native_crypto.cc b/common/src/jni/main/cpp/conscrypt/native_crypto.cc index ef9256df7..9f8bf4ee3 100644 --- a/common/src/jni/main/cpp/conscrypt/native_crypto.cc +++ b/common/src/jni/main/cpp/conscrypt/native_crypto.cc @@ -3850,12 +3850,12 @@ static jbyteArray NativeCrypto_EVP_DigestSign(JNIEnv* env, jclass, jobject evpMd jint in_offset = inOffset; jint in_size = inLength; - jbyte* array_elements = env->GetByteArrayElements(inJavaBytes, nullptr); - if (array_elements == nullptr) { + ScopedByteArrayRO array_elements(env, inJavaBytes); + if (array_elements.get() == nullptr) { conscrypt::jniutil::throwOutOfMemory(env, "Unable to obtain elements of inBytes"); return nullptr; } - const unsigned char* buf = reinterpret_cast(array_elements); + const unsigned char* buf = reinterpret_cast(array_elements.get()); const unsigned char* inStart = buf + in_offset; size_t inLen = static_cast(in_size); diff --git a/common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java b/common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java index 7bf176643..521266a28 100644 --- a/common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java +++ b/common/src/test/java/org/conscrypt/java/security/KeyPairGeneratorTest.java @@ -162,6 +162,8 @@ private static List getKeySizes(String algorithm) throws Exception { putKeySize("ML-DSA-87", -1); putKeySize("SLH-DSA-SHA2-128S", -1); putKeySize("XWING", -1); + putKeySize("MLDSA44-Ed25519-SHA512", -1); + putKeySize("MLDSA65-Ed25519-SHA512", -1); } /** Elliptic Curve Crypto named curves that should be supported. */ @@ -284,8 +286,8 @@ private void test_Key(KeyPairGenerator kpg, Key k) throws Exception { // serializable, so just skip them. return; } - if (expectedAlgorithm.equals("ML-DSA")) { - // ML-DSA keys are not yet serializable, so just skip them. + if (expectedAlgorithm.equals("ML-DSA") || expectedAlgorithm.startsWith("MLDSA")) { + // ML-DSA and Composite ML-DSA keys are not yet serializable, so just skip them. return; } if (expectedAlgorithm.equals("ML-KEM")) { diff --git a/common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java b/common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java index 2bcb67c9a..f161b5073 100644 --- a/common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java +++ b/common/src/test/java/org/conscrypt/javax/net/ssl/SSLSocketTest.java @@ -1043,14 +1043,19 @@ public void handshake_p256IsSupportedByDefault() throws Exception { s.get(); c.get(); // By default, BoringSSL uses X25519, P-256, and P-384. + // On newer versions of BoringSSL, X25519MLKEM768 is also a default. if (sslParametersSupportsNamedGroups()) { // If the client requests P-256, it will be chosen. assertEquals("P-256", getCurveName(client)); assertEquals("P-256", getCurveName(server)); } else { - // Otherwise, X25519 gets priority. - assertEquals("X25519", getCurveName(client)); - assertEquals("X25519", getCurveName(server)); + // Otherwise, X25519 or X25519MLKEM768 gets priority. + String clientCurve = getCurveName(client); + String serverCurve = getCurveName(server); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve, + clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768")); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve, + serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768")); } client.close(); server.close(); @@ -1078,14 +1083,19 @@ public void handshake_p384IsSupportedByDefault() throws Exception { s.get(); c.get(); // By default, BoringSSL uses X25519, P-256, and P-384. + // On newer versions of BoringSSL, X25519MLKEM768 is also a default. if (sslParametersSupportsNamedGroups()) { // If the client requests P-384, it will be chosen. assertEquals("P-384", getCurveName(client)); assertEquals("P-384", getCurveName(server)); } else { - // Otherwise, X25519 gets priority. - assertEquals("X25519", getCurveName(client)); - assertEquals("X25519", getCurveName(server)); + // Otherwise, X25519 or X25519MLKEM768 gets priority. + String clientCurve = getCurveName(client); + String serverCurve = getCurveName(server); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve, + clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768")); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve, + serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768")); } client.close(); server.close(); @@ -1120,9 +1130,13 @@ public void handshake_setsNamedGroups_usesFirstServerNamedGroupThatClientSupport assertEquals("P-384", getCurveName(client)); assertEquals("P-384", getCurveName(server)); } else { - // The defaults are used, and X25519 gets priority. - assertEquals("X25519", getCurveName(client)); - assertEquals("X25519", getCurveName(server)); + // The defaults are used, and X25519 or X25519MLKEM768 gets priority. + String clientCurve = getCurveName(client); + String serverCurve = getCurveName(server); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve, + clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768")); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve, + serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768")); } client.close(); server.close(); @@ -1179,9 +1193,13 @@ public void handshake_setsNamedGroupsBeforeAccept_usesFirstServerNamedGroupThatC assertEquals("P-384", getCurveName(client)); assertEquals("P-384", getCurveName(server)); } else { - // The defaults are used, and X25519 gets priority. - assertEquals("X25519", getCurveName(client)); - assertEquals("X25519", getCurveName(server)); + // The defaults are used, X25519 or X25519MLKEM768 gets priority. + String clientCurve = getCurveName(client); + String serverCurve = getCurveName(server); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve, + clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768")); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve, + serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768")); } client.close(); server.close(); @@ -1214,9 +1232,13 @@ public void handshake_withX25519MLKEM768_works() throws Exception { assertEquals("X25519MLKEM768", getCurveName(client)); assertEquals("X25519MLKEM768", getCurveName(server)); } else { - // The defaults are used, and X25519 gets priority. - assertEquals("X25519", getCurveName(client)); - assertEquals("X25519", getCurveName(server)); + // The defaults are used, and X25519 or X25519MLKEM768 gets priority. + String clientCurve = getCurveName(client); + String serverCurve = getCurveName(server); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve, + clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768")); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve, + serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768")); } client.close(); server.close(); @@ -1309,9 +1331,13 @@ public void handshake_namedGroupsDontIntersect_throwsException() throws Exceptio } else { s.get(); c.get(); - // The defaults are used, and X25519 gets priority. - assertEquals("X25519", getCurveName(client)); - assertEquals("X25519", getCurveName(server)); + // The defaults are used, and X25519 or X25519MLKEM768 gets priority. + String clientCurve = getCurveName(client); + String serverCurve = getCurveName(server); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + clientCurve, + clientCurve.equals("X25519") || clientCurve.equals("X25519MLKEM768")); + assertTrue("Curve is not X25519 or X25519MLKEM768: " + serverCurve, + serverCurve.equals("X25519") || serverCurve.equals("X25519MLKEM768")); } client.close(); server.close(); diff --git a/openjdk-uber/build.gradle b/openjdk-uber/build.gradle index 2d9e29839..c8b527007 100644 --- a/openjdk-uber/build.gradle +++ b/openjdk-uber/build.gradle @@ -113,6 +113,7 @@ if (buildUberJar) { attributes ('BoringSSL-Version': boringSslVersion, 'Automatic-Module-Name': 'org.conscrypt', 'Bundle-SymbolicName': 'org.conscrypt', + 'Import-Package': '!android.util,*', '-exportcontents': 'org.conscrypt.*') } diff --git a/openjdk/build.gradle b/openjdk/build.gradle index 58332623c..d0a7aded8 100644 --- a/openjdk/build.gradle +++ b/openjdk/build.gradle @@ -278,6 +278,7 @@ jar.manifest { attributes ('BoringSSL-Version' : boringSslVersion, 'Automatic-Module-Name' : 'org.conscrypt', 'Bundle-SymbolicName': 'org.conscrypt', + 'Import-Package': '!android.util,*', '-exportcontents': 'org.conscrypt.*') }