Search code, repositories, users, issues, pull requests...

@boring-cyborg boring-cyborg bot added component:build component:console-proxy component:kubernetes labels

Jul 15, 2025

Copy link

Member Author

harikrishna-patnala commented Jul 15, 2025

@blueorangutan package

Copy link

blueorangutan commented Jul 15, 2025

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

@codecov

Copy link

codecov bot commented Jul 15, 2025 •

edited

Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 17.60%. Comparing base (286e406) to head (64d2dce).

Additional details and impacted files

@@ Coverage Diff @@
## 4.22 #11201 +/- ##
=========================================
 Coverage 17.60% 17.60% 
- Complexity 15624 15626 +2 
=========================================
 Files 5911 5911 
 Lines 530169 530169 
 Branches 64785 64785 
=========================================
+ Hits 93322 93344 +22 
+ Misses 426342 426319 -23 
- Partials 10505 10506 +1

Flag	Coverage Δ
uitests	`3.60% <ø> (ø)`
unittests	`18.67% <ø> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link

blueorangutan commented Jul 15, 2025

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 14192

@DaanHoogland

Copy link

Contributor

DaanHoogland commented Jul 15, 2025

@blueorangutan test matrix

Copy link

blueorangutan commented Jul 15, 2025

@DaanHoogland a [SL] Trillian-Jenkins matrix job (EL8 mgmt + EL8 KVM, Ubuntu22 mgmt + Ubuntu22 KVM, EL8 mgmt + VMware 7.0u3, EL9 mgmt + XCP-ng 8.2 ) has been kicked to run smoke tests

Copy link

blueorangutan commented Jul 15, 2025

[SF] Trillian Build Failed (tid-13786)

Copy link

blueorangutan commented Jul 15, 2025

[SF] Trillian Build Failed (tid-13784)

Copy link

blueorangutan commented Jul 15, 2025

[SF] Trillian Build Failed (tid-13785)

Copy link

blueorangutan commented Jul 15, 2025

[SF] Trillian Build Failed (tid-13783)

Copy link

Member Author

harikrishna-patnala commented Jul 17, 2025

@blueorangutan test matrix

Copy link

blueorangutan commented Jul 17, 2025

@harikrishna-patnala a [SL] Trillian-Jenkins matrix job (EL8 mgmt + EL8 KVM, Ubuntu22 mgmt + Ubuntu22 KVM, EL8 mgmt + VMware 7.0u3, EL9 mgmt + XCP-ng 8.2 ) has been kicked to run smoke tests

Copy link

blueorangutan commented Jul 17, 2025

[SF] Trillian Build Failed (tid-13806)

Copy link

blueorangutan commented Jul 17, 2025

[SF] Trillian Build Failed (tid-13808)

Copy link

blueorangutan commented Jul 17, 2025

[SF] Trillian Build Failed (tid-13807)

Copy link

blueorangutan commented Jul 17, 2025

[SF] Trillian Build Failed (tid-13805)

Copy link

Member Author

harikrishna-patnala commented Jul 18, 2025

@blueorangutan package

Copy link

blueorangutan commented Jul 18, 2025

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

@weizhouapache @DaanHoogland

Copy link

Member Author

harikrishna-patnala commented Jul 18, 2025 •

edited

Loading

The available versions for bouncy castle provider supporting jdk18 starts from 1.71 to 1.81 (https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on)

If we use 1.81 as the provider version

<cs.bcprov.version>1.81</cs.bcprov.version>

SystemVMs have trouble starting with the error

Caused by: java.lang.NoClassDefFoundError: Could not initialize class org.bouncycastle.operator.jcajce.OperatorHelper
 at org.bouncycastle.operator.jcajce.JcaContentSignerBuilder.<init>(Unknown Source)
 at org.apache.cloudstack.utils.security.CertUtils.generateV3Certificate(CertUtils.java:241)
 at org.apache.cloudstack.ca.provider.RootCAProvider.generateCertificate(RootCAProvider.java:152)

The last version that worked with our code is

<cs.bcprov.version>1.72</cs.bcprov.version>

At the moment I don't know the reason for "OperatorHelper" class not being found, so I adjusted the code to use 1.72 version. I'm not sure how the mentioned vulnerabilities effects us https://mvnrepository.com/artifact/org.bouncycastle/bcprov-jdk18on/1.72

Please review and see if this is fine.

Copy link

blueorangutan commented Jul 18, 2025

Packaging result [SF]: ✔️ el8 ✔️ el9 ✖️ debian ✔️ suse15. SL-JID 14254

vishesh92

vishesh92 approved these changes

Jul 18, 2025

View reviewed changes

Copy link

Member

@vishesh92 vishesh92 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

clgtm

@harikrishna-patnala harikrishna-patnala closed this

Jul 18, 2025

@harikrishna-patnala harikrishna-patnala reopened this

Jul 18, 2025

[Security] switch to jdk18on bouncycastle jars #10954

Copy link

blueorangutan commented Jul 18, 2025

Packaging result [SF]: ✔️ el8 ✔️ el9 ✖️ debian ✔️ suse15. SL-JID 14256

weizhouapache

weizhouapache reviewed

Jul 19, 2025

View reviewed changes

pom.xml Outdated

<cs.axis2.version>1.6.4</cs.axis2.version>

<cs.batik.version>1.14</cs.batik.version>

<cs.bcprov.version>1.70</cs.bcprov.version>

<cs.bcprov.version>1.72</cs.bcprov.version>

Copy link

Member

@weizhouapache weizhouapache Jul 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to central mvn repo, 1.72 has 5 vulnerabilities, 1.81 is the latest

It seems here are some imcompatibility issue with 1.81, I think it can be fixed

Copy link

Contributor

@sureshanaparti sureshanaparti Jul 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@harikrishna-patnala check if the issues with 1.81 can be fixed or not

Copy link

Member Author

@harikrishna-patnala harikrishna-patnala Jul 23, 2025 •

edited

Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've tried multiple ways to use 1.81 and rewriting code for getting X509Certificate but still facing the same issue. Can someone of you help me here @weizhouapache @sureshanaparti

@sureshanaparti sureshanaparti requested a review from DaanHoogland

July 20, 2025 15:47

@sureshanaparti sureshanaparti linked an issue

Jul 25, 2025

that may be closed by this pull request

Open

@borisstoyanov borisstoyanov marked this pull request as ready for review

January 29, 2026 06:14

Copilot AI review requested due to automatic review settings

January 29, 2026 06:14

Copilot started reviewing on behalf of borisstoyanov

January 29, 2026 06:15

View session

Copilot AI reviewed

View reviewed changes

Copy link

Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates Apache CloudStack’s BouncyCastle dependencies to the jdk18on artifact line and bumps the shared BouncyCastle version to address the security concern in #10954.

Changes:

Replace bcprov/bcpkix/bctls -jdk15on artifacts with -jdk18on across affected modules.
Bump ${cs.bcprov.version} from 1.70 to 1.82 and align dependencyManagement entries accordingly.
Update client build/shade/dependency-copy references and exclusions to match the new artifact IDs.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`pom.xml`	Bumps BouncyCastle version property and updates dependencyManagement to `-jdk18on` artifacts.
`utils/pom.xml`	Switches direct BouncyCastle dependencies to `bcprov/bcpkix/bctls-jdk18on`.
`services/console-proxy/rdpconsole/pom.xml`	Switches RDP console BouncyCastle dependencies to `bcprov/bctls-jdk18on`.
`plugins/integrations/kubernetes-service/pom.xml`	Updates Kubernetes plugin BouncyCastle dependencies to `bcprov/bctls-jdk18on`.
`client/pom.xml`	Updates Jetty plugin deps, dependency-plugin copies, and shade exclusions to `-jdk18on` artifacts.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@harikrishna-patnala harikrishna-patnala force-pushed the switchBouncyCastleJars branch from 6138c02 to 207f819 Compare

January 29, 2026 06:47

@boring-cyborg boring-cyborg bot added component:api component:backup component:management-server component:networking component:storage component:UI component:virtual-router distro:ubuntu Python labels

@harikrishna-patnala harikrishna-patnala changed the base branch from main to 4.22

January 29, 2026 06:47

harikrishna-patnala and others added 3 commits

January 29, 2026 12:18


 switch to jdk18on bouncycastle jars

5369ecd

@weizhouapache @harikrishna-patnala


 Version change

57fe448


 Update bcprov to 1.82 in pom.xml

64d2dce

@harikrishna-patnala harikrishna-patnala force-pushed the switchBouncyCastleJars branch from 207f819 to 64d2dce Compare

January 29, 2026 06:48

Copy link

Member Author

harikrishna-patnala commented Jan 29, 2026

@blueorangutan package

@harikrishna-patnala harikrishna-patnala added the status:needs-testing label

Copy link

blueorangutan commented Jan 29, 2026

@harikrishna-patnala a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

Copy link

Member Author

harikrishna-patnala commented Jan 29, 2026

@borisstoyanov last time we had issues in deploying the system VMs, we need to check if that is still the case

Copy link

blueorangutan commented Jan 29, 2026

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16609

Copy link

Member Author

harikrishna-patnala commented Jan 29, 2026

@blueorangutan test

Copy link

blueorangutan commented Jan 29, 2026

@harikrishna-patnala a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

@harikrishna-patnala harikrishna-patnala marked this pull request as draft

January 29, 2026 09:06

Copy link

Member Author

harikrishna-patnala commented Jan 29, 2026

This PR still has issues with systemVMs and host additions cc @DaanHoogland

Copy link

blueorangutan commented Jan 29, 2026

[SF] Trillian Build Failed (tid-15333)

@borisstoyanov borisstoyanov removed their assignment