CI: Add automated PQCA CBOM (Cryptography Bill of Materials) generation - #2370
Open
xaexaex wants to merge 4128 commits into
Open
CI: Add automated PQCA CBOM (Cryptography Bill of Materials) generation#2370xaexaex wants to merge 4128 commits into
xaexaex wants to merge 4128 commits into
Conversation
- improve attribute validation and prepare for more
…allocation DoS, relates to github bcgit#2338.
…dd StreamsTest, relates to github bcgit#2338.
EthereumIESEngine: close static-key stream-mode cross-message MAC forgery See merge request root/bc-java!237
ArmoredOutputStream / PemWriter: reject CR/LF in header name/value (header injection) See merge request root/bc-java!232
…ew SecureRandom()` per operation
MLS SecureRandom hygiene: source from the Group / registrar, never `new SecureRandom()` per operation See merge request root/bc-java!212
GF(2^8) / GF(2^4) arithmetic consolidation onto constant-time util.GF256 / util.GF16 See merge request root/bc-java!215
EAX / CCM / OCB / KCCM: reject nonce reuse on re-init for encryption See merge request root/bc-java!226
AIMer See merge request root/bc-java!133
…bgroup confinement)
ElGamalEngine: validate ciphertext components on decryption (small-subgroup confinement) See merge request root/bc-java!236
Fix `PKIXCertPathReviewer.getPolicyTree()` always returning `null` See merge request root/bc-java!217
…nstraints per RFC 5280 sec. 4.2.1.10, relates to github bcgit#2331.
RFC 8702 — SHAKE in CMS: KMAC-with-SHAKE support See merge request root/bc-java!185
…e with a commonName longer than the RFC 5280 64-character bound
…dule so examples compile and smoke-test under CI without shipping in the bc jars
… configurable node limit (org.bouncycastle.x509.max_cert_path_build_nodes)
…e *Test classes from the bcprov copy, and relocate OwlUtilTest to its own AllTests so it builds under bctest
…jar junit test-sweeping OSGi gotcha in docs/claude/build-jdk14.md
…aging to avoid the OwlUtilTest bcprov signer-info clash, matching the lms/mayo/est/keybox pattern
…09CRLEntryObject/RFC3280/X509CertificateObject/BaseBlockCipher, new PQC KeyPairGeneratorSpi overlays with NoSuchProviderException catch, SM2Signer/Utils), the Falcon FPREngine JLS2 forward-reference fix, and drop the KEM cipher families so bcprov-jdk13 compiles clean
…ed NPE/AIOOBE
Consolidates the empty/missing-content parser-robustness fixes into one review unit.
Each entry point converts an unchecked runtime exception (NullPointerException,
ArrayIndexOutOfBoundsException, IllegalStateException or ArithmeticException) that
escaped on empty / content-less / truncated / out-of-range input into the checked
exception it already declares; the malformed input is rejected either way, only the
leaked exception type is corrected. Well-formed input is unaffected.
Parse entry points:
tsp.cms.CMSTimeStampedData (+ asn1.cms.MetaData, tsp.cms.TimeStampDataUtil)
cms.CMSEnvelopedData (EnvelopedData with no encryptedContent)
tsp.TimeStampToken (SignerInfo carrying no signed attributes)
tsp.TimeStampRequest, tsp.TimeStampResponse (empty/truncated stream)
cert.cmp.GeneralPKIMessage, est.CSRAttributesResponse, cmc.SimplePKIResponse,
openssl.X509TrustedCertificateBlock, pkcs.PKCS12PfxPdu,
pkcs.PKCS8EncryptedPrivateKeyInfo (empty / no-content input)
cert.crmf.CertificateRequestMessage.hasSigningKeyProofOfPossessionWithPKMAC
crypto.util.OpenSSHPrivateKeyUtil.parsePrivateKeyBlob, math.ec.ECCurve.decodePoint
PKIX revocation reporting (attacker-controlled CRL/OCSP fields):
pkix.jcajce.PKIXCertPathReviewer, pkix.jcajce.X509RevocationChecker
(out-of-range CRLReason index against the fixed reason table)
jce.provider.RFC3280CertPathUtilities (absent CRL distribution-point reasons mask)
jce.provider.ProvOcspRevocationChecker (OCSP response with no nonce extension)
Audit findings F16, F23, F24, F26, F28, F29, F30, F32, F52 plus the
parse-empty-input-null-guards, tsp-empty-stream-parse-guard and
crl-reasoncode-crlreasons-aioobe branches.
…ith destroy() throws DestroyFailedException resolved via the jce/src backport on the build-lw classpath, plus jdk14-parity cades excludes and jce/lcrypto test-contamination excludes
… and register it in the cert test AllTests suite
…tering its encapsulation lengths, with a round-trip test covering the AES-Wrap-192/256 mappings from draft-chen-lamps-cms-frodokem
…ntInfo generate side, binding the ukm field into the KDF otherInfo, with round-trip and tamper tests
…n CMS EnvelopedData, add the twelve composite encapsulation lengths, with a round-trip test over all parameter sets
…ssage through SecurityExceptions.invalidKeyException so the cause is chained (and stays Java 4 safe), across the KEM CipherSpis and the RSA/ElGamal/Falcon/Dilithium/composite paths
…rough SecurityExceptions.illegalBlockSizeException so the cause is chained, matching the sibling KEM CipherSpis
…ng NoSuchAlgorithmException throws through it so the cause is chained (and stays Java 4 safe), across the KEM CipherSpis, X509CRL/Certificate, BCFKS and JcaPKCS10CertificationRequest
…th CMS AuthEnvelopedData AEAD content, with ML-KEM/FrodoKEM/Composite round-trip tests
…ing the full draft-ietf-lamps-cms-composite-kem wrap/KDF/KEM mapping
…complete encoding and nothing extra; add byte[]/InputStream constructors to CMSEncryptedData
…n v3/checkout v4, use build-mode none (Gradle needs JDK 25 so autobuild cannot compile)
This workflow automates the creation and upload of a Component Bill of Materials (CBOM) for Java projects.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR adds a GitHub Action to automatically generate a CycloneDX 1.6 Cryptography Bill of Materials (CBOM) for the Bouncy Castle project upon demand.
As the industry transitions to Post-Quantum Cryptography (PQC), global regulatory frameworks (such as US Executive Order 14028, NIST guidelines, and EU DORA) increasingly mandate strict cryptographic asset visibility. By utilizing the official Linux Foundation / PQCA
cbomkit-action, this workflow automatically inventories all cryptographic primitives (including ML-KEM and SLH-DSA) and attaches the resultingcbom.jsonas an artifact.Motivation
Providing a verifiable CBOM allows enterprise consumers worldwide to immediately validate Bouncy Castle's PQC readiness and integrate the library's cryptographic inventory directly into their global compliance and risk management pipelines.
Licensing & Safety
cbomkit-actionprovided by the Post-Quantum Cryptography Alliance (Linux Foundation).Testing
cbom.jsoncontaining 301 cryptographic assets mapping both classical and PQC algorithms.