Spongy Castle (Bouncy Castle repackage for Android) - v1.50 release

[Roberto Tyley-2]

Release notes:

https://github.com/rtyley/spongycastle/releases/tag/sc-v1.50.0.0

This is the first release of Spongy Castle completed since Bouncy Castle a) started using Git, and b) introduced a Gradle build. Both those things are great, and make the task of releasing Spongy Castle substantially easier for me, but it's still taken several weeks of spare-time hacking to get a working 1.50 release - and that's *just* to patch the Bouncy Castle codebase to the point where the Gradle build completes and passes tests. Many of these changes have been submitted back to the Bouncy Castle project as half-dozen-or-so pull-requests, and I'd be grateful if they could be merged back into the project so that others can get the benefit of those fixes:

https://github.com/bcgit/bc-java/pulls/rtyley

Beyond that, it would be very helpful if the Bouncy Castle project could take up use of a continuous-integration service like Travis CI, to ensure that the Gradle build isn't broken again.

As an example, I use a free Travis continuous-integration build for Spongy Castle, you can see the (very simple) definition file here:

https://github.com/rtyley/spongycastle/blob/d3cab6b1/.travis.yml

...and here's the travis-ci build report against the most recent release of Spongy Castle:

https://travis-ci.org/rtyley/spongycastle/builds/17661074

It's possible to get BC to a reliable, simple, no-config-required build that any developer can check out and start working with immediately - it would be great if we could get there.

best regards,

Roberto Tyley

[Daniele Ricci]

Thank you Roberto! I was looking forward to this release.

It would be great if the two project were merged... I mean something
like a script which "converts" all references to BC into SC (I mean as
an eventuality of all fixes by Roberto being merged to BC).

Keep up with the great work.

On Mon, Jan 27, 2014 at 11:54 PM, Roberto Tyley <[hidden email]> wrote:

> Release notes:
>
> https://github.com/rtyley/spongycastle/releases/tag/sc-v1.50.0.0
>
> This is the first release of Spongy Castle completed since Bouncy Castle a)
> started using Git, and b) introduced a Gradle build. Both those things are
> great, and make the task of releasing Spongy Castle substantially easier for
> me, but it's still taken several weeks of spare-time hacking to get a
> working 1.50 release - and that's *just* to patch the Bouncy Castle codebase
> to the point where the Gradle build completes and passes tests. Many of
> these changes have been submitted back to the Bouncy Castle project as
> half-dozen-or-so pull-requests, and I'd be grateful if they could be merged
> back into the project so that others can get the benefit of those fixes:
>
> https://github.com/bcgit/bc-java/pulls/rtyley
>
> Beyond that, it would be very helpful if the Bouncy Castle project could
> take up use of a continuous-integration service like Travis CI, to ensure
> that the Gradle build isn't broken again.
>
> As an example, I use a free Travis continuous-integration build for Spongy
> Castle, you can see the (very simple) definition file here:
>
> https://github.com/rtyley/spongycastle/blob/d3cab6b1/.travis.yml
>
> ...and here's the travis-ci build report against the most recent release of
> Spongy Castle:
>
> https://travis-ci.org/rtyley/spongycastle/builds/17661074
>
> It's possible to get BC to a reliable, simple, no-config-required build that
> any developer can check out and start working with immediately - it would be
> great if we could get there.
>
> best regards,
> Roberto Tyley

--
Daniele

[Michael Rogers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi Daniele,

I use the following script for converting Bouncy Castle to Spongy
Castle (or any other name that doesn't conflict with Bouncy Castle)
for use on Android. This works for the lightweight API, but I imagine
you'd run into problems using it for the JCE provider, because it
doesn't replace references to the provider name, "BC".

This is just a quick hack - I'm sure there are many issues with this
approach that the real Spongy Castle fixes, but I've been lucky enough
not to run into them.

Just clone the Bouncy Castle git repo, run this script, then run 'ant
- -f ant/jdk15+.xml build-lw'. The classfiles are left in
build/artifacts/jdk1.5/lcrypto-jdk15on-150/classes and can be jarred
up from there.

If you want to build the PGP stuff you'll also need to add mail.jar to
the classpath.

Cheers,
Michael

================

#!/bin/bash

dirs=(ant core docs jce mail pg pkix prov)

for file in `find ${dirs[@]} -name bouncycastle`
do
        path=`dirname $file`
        echo "Moving $file to $path/spongycastle"
        mv $file $path/spongycastle
done

for file in `grep -Rl bouncycastle ${dirs[@]}`
do
        echo "Replacing string bouncycastle in $file"
        sed -i 's/bouncycastle/spongycastle/g' $file
done

================

On 28/01/14 09:33, Daniele Ricci wrote:

> Thank you Roberto! I was looking forward to this release.
>
> It would be great if the two project were merged... I mean
> something like a script which "converts" all references to BC into
> SC (I mean as an eventuality of all fixes by Roberto being merged
> to BC).
>
> Keep up with the great work.
>
> On Mon, Jan 27, 2014 at 11:54 PM, Roberto Tyley
> <[hidden email]> wrote:
>> Release notes:
>>
>> https://github.com/rtyley/spongycastle/releases/tag/sc-v1.50.0.0
>>
>> This is the first release of Spongy Castle completed since Bouncy
>> Castle a) started using Git, and b) introduced a Gradle build.
>> Both those things are great, and make the task of releasing
>> Spongy Castle substantially easier for me, but it's still taken
>> several weeks of spare-time hacking to get a working 1.50 release
>> - and that's *just* to patch the Bouncy Castle codebase to the
>> point where the Gradle build completes and passes tests. Many of
>> these changes have been submitted back to the Bouncy Castle
>> project as half-dozen-or-so pull-requests, and I'd be grateful if
>> they could be merged back into the project so that others can get
>> the benefit of those fixes:
>>
>> https://github.com/bcgit/bc-java/pulls/rtyley
>>
>> Beyond that, it would be very helpful if the Bouncy Castle
>> project could take up use of a continuous-integration service
>> like Travis CI, to ensure that the Gradle build isn't broken
>> again.
>>
>> As an example, I use a free Travis continuous-integration build
>> for Spongy Castle, you can see the (very simple) definition file
>> here:
>>
>> https://github.com/rtyley/spongycastle/blob/d3cab6b1/.travis.yml
>>
>> ...and here's the travis-ci build report against the most recent
>> release of Spongy Castle:
>>
>> https://travis-ci.org/rtyley/spongycastle/builds/17661074
>>
>> It's possible to get BC to a reliable, simple, no-config-required
>> build that any developer can check out and start working with
>> immediately - it would be great if we could get there.
>>
>> best regards, Roberto Tyley
>
>
>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBCgAGBQJS59P6AAoJEBEET9GfxSfMCQQH/0Zy6KA+hGjpb+TydJsCh8da
QbrHzVm3CpiJdtxpfvZhDYl5bwfjrenjmY57bi7kES8mrOlpYGD/8sygiLmbHma6
0Dhh43Gyg+pCUa/ltMUoHk2kwfiLLYa42A+jm6NwOjaIM64a/IAN9jnhIARGWWhj
1BCQnkGJqbVu+ZiGJqf8+63k64b9Xlu+MDud98aLd6tLFJIx9UJPRNo/mSN2gKAd
6u1LDbGHrak/77lApIZkBcnB3K4Qd5DmNU0bqk0iDeHhIkXQOwOhFx/kuDLapAmp
L4GA1wQ9t6CW7Z0rW7WVYPfwTp9XzSFIAHAba6Ct2ieuumsHM1NRWiS+LwFxd9s=
=roUD
-----END PGP SIGNATURE-----

[Michael Rogers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 28/01/14 15:59, Michael Rogers wrote:
> Just clone the Bouncy Castle git repo, run this script, then run
> 'ant -f ant/jdk15+.xml build-lw'. The classfiles are left in

Sorry, GPG or Enigmail or Thunderbird has a habit of inserting an
extra dash when a line starts with a dash. This should be 'ant -f', in
case it doesn't appear that way in your mail reader.

Cheers,
Michael
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBCgAGBQJS59UxAAoJEBEET9GfxSfMaq4H+we5AHfYGC5cpoJtTPEoKE2/
j9PzNTIhytU7tLFGvfMqNZuaxz1g2GY+KPOCBWYt1HTN7BBuL1zjnGMAbtDBmHLU
MbKR/jDI570AeJRuTCnXoXiKamuSWlHutKuZKw80Ajvn1w7V/DGWiya8wGc5CD5l
SvcK5lbveC/fHu4kjOQXDWeqYtHnru91wu0F3/tbe0SoH9tFDRUK+mvF0EgP/z8i
Rj36/QWjMBZ3IbwYvpOz/rpqG+o0xd2odHv0S9TWbsXb03z1ekSz3auDMVItuhe9
8cLCP+1ee6nqKhImLSjKggQkhb7zxS3y/YAzEnVrsQnFQLxq2i60fh7WrS1/Kyw=
=aYVk
-----END PGP SIGNATURE-----

[Matthew Hall]

A script called something like make_spongy exists in the SpongyCastle code which does the trick. ;)

Matthew.
--
Sent from my mobile device.

On January 28, 2014 7:59:55 AM PST, Michael Rogers <[hidden email]> wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA512
>
>Hi Daniele,
>
>I use the following script for converting Bouncy Castle to Spongy
>Castle (or any other name that doesn't conflict with Bouncy Castle)
>for use on Android. This works for the lightweight API, but I imagine
>you'd run into problems using it for the JCE provider, because it
>doesn't replace references to the provider name, "BC".
>
>This is just a quick hack - I'm sure there are many issues with this
>approach that the real Spongy Castle fixes, but I've been lucky enough
>not to run into them.
>
>Just clone the Bouncy Castle git repo, run this script, then run 'ant
>- -f ant/jdk15+.xml build-lw'. The classfiles are left in
>build/artifacts/jdk1.5/lcrypto-jdk15on-150/classes and can be jarred
>up from there.
>
>If you want to build the PGP stuff you'll also need to add mail.jar to
>the classpath.
>
>Cheers,
>Michael
>
>================
>
>#!/bin/bash
>
>dirs=(ant core docs jce mail pg pkix prov)
>
>for file in `find ${dirs[@]} -name bouncycastle`
>do
> path=`dirname $file`
> echo "Moving $file to $path/spongycastle"
> mv $file $path/spongycastle
>done
>
>for file in `grep -Rl bouncycastle ${dirs[@]}`
>do
> echo "Replacing string bouncycastle in $file"
> sed -i 's/bouncycastle/spongycastle/g' $file
>done
>
>================
>
>On 28/01/14 09:33, Daniele Ricci wrote:
>> Thank you Roberto! I was looking forward to this release.
>>
>> It would be great if the two project were merged... I mean
>> something like a script which "converts" all references to BC into
>> SC (I mean as an eventuality of all fixes by Roberto being merged
>> to BC).
>>
>> Keep up with the great work.
>>
>> On Mon, Jan 27, 2014 at 11:54 PM, Roberto Tyley
>> <[hidden email]> wrote:
>>> Release notes:
>>>
>>> https://github.com/rtyley/spongycastle/releases/tag/sc-v1.50.0.0
>>>
>>> This is the first release of Spongy Castle completed since Bouncy
>>> Castle a) started using Git, and b) introduced a Gradle build.
>>> Both those things are great, and make the task of releasing
>>> Spongy Castle substantially easier for me, but it's still taken
>>> several weeks of spare-time hacking to get a working 1.50 release
>>> - and that's *just* to patch the Bouncy Castle codebase to the
>>> point where the Gradle build completes and passes tests. Many of
>>> these changes have been submitted back to the Bouncy Castle
>>> project as half-dozen-or-so pull-requests, and I'd be grateful if
>>> they could be merged back into the project so that others can get
>>> the benefit of those fixes:
>>>
>>> https://github.com/bcgit/bc-java/pulls/rtyley
>>>
>>> Beyond that, it would be very helpful if the Bouncy Castle
>>> project could take up use of a continuous-integration service
>>> like Travis CI, to ensure that the Gradle build isn't broken
>>> again.
>>>
>>> As an example, I use a free Travis continuous-integration build
>>> for Spongy Castle, you can see the (very simple) definition file
>>> here:
>>>
>>> https://github.com/rtyley/spongycastle/blob/d3cab6b1/.travis.yml
>>>
>>> ...and here's the travis-ci build report against the most recent
>>> release of Spongy Castle:
>>>
>>> https://travis-ci.org/rtyley/spongycastle/builds/17661074
>>>
>>> It's possible to get BC to a reliable, simple, no-config-required
>>> build that any developer can check out and start working with
>>> immediately - it would be great if we could get there.
>>>
>>> best regards, Roberto Tyley
>>
>>
>>
>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.4.10 (GNU/Linux)
>
>iQEcBAEBCgAGBQJS59P6AAoJEBEET9GfxSfMCQQH/0Zy6KA+hGjpb+TydJsCh8da
>QbrHzVm3CpiJdtxpfvZhDYl5bwfjrenjmY57bi7kES8mrOlpYGD/8sygiLmbHma6
>0Dhh43Gyg+pCUa/ltMUoHk2kwfiLLYa42A+jm6NwOjaIM64a/IAN9jnhIARGWWhj
>1BCQnkGJqbVu+ZiGJqf8+63k64b9Xlu+MDud98aLd6tLFJIx9UJPRNo/mSN2gKAd
>6u1LDbGHrak/77lApIZkBcnB3K4Qd5DmNU0bqk0iDeHhIkXQOwOhFx/kuDLapAmp
>L4GA1wQ9t6CW7Z0rW7WVYPfwTp9XzSFIAHAba6Ct2ieuumsHM1NRWiS+LwFxd9s=
>=roUD
>-----END PGP SIGNATURE-----

[Michael Rogers]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 28/01/14 16:06, Matthew Hall wrote:
> A script called something like make_spongy exists in the
> SpongyCastle code which does the trick. ;)

That script seems to have disappeared in recent versions, which is why
I wrote my own. :-) But I'm sure there's a good reason it disappeared,
so I don't mean to suggest my script is a replacement for the real
Spongy Castle.

Cheers,
Michael

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBCgAGBQJS59crAAoJEBEET9GfxSfM2AQH/2RUkItmiqtV4NYQH9bd/G9p
aZIdU+7n0sptvv010b0jkHLFufNhT9jQywesQWknsqJvVQ4zSDBjYMsjsuTEBUSm
bQeVdh7ZYRMULgPsF4eUfR0FzPy8nZYEgdZUQRmgdLWsM5dSc/gu8bE8XhIx7Bo9
oyB9fkowoEKBaPtbpIVf8eBnQTD6YrZXOIvB+LfVlymIcKIkF90XbBYiCuCW0JRC
cRSPp9q6tTRsoAwJbz0vDXyeJSxU0Fo9VhSnVi/zqr5ge4enMsDzHE2eZoQndV/0
hKWj+JlFwtQoijlNGO4F/mrVlBuVyDqnagij1m51E6wV8eJrCvS4w1vdj8yAxr0=
=nD+m
-----END PGP SIGNATURE-----

[Daniele Ricci]

Thanks Michael,
I've wrote something similar to do the package name change (while I
was playing with BC beta versions), but as you said there might be
other issues when running Bouncy Castle "just renamed" on Android. I
was actually suggesting that the two projects work together so Bouncy
Castle can be compiled for both environments with an automated build
procedure.

On Tue, Jan 28, 2014 at 4:59 PM, Michael Rogers
<[hidden email]> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA512
>
> Hi Daniele,
>
> I use the following script for converting Bouncy Castle to Spongy
> Castle (or any other name that doesn't conflict with Bouncy Castle)
> for use on Android. This works for the lightweight API, but I imagine
> you'd run into problems using it for the JCE provider, because it
> doesn't replace references to the provider name, "BC".
>
> This is just a quick hack - I'm sure there are many issues with this
> approach that the real Spongy Castle fixes, but I've been lucky enough
> not to run into them.
>
> Just clone the Bouncy Castle git repo, run this script, then run 'ant
> - -f ant/jdk15+.xml build-lw'. The classfiles are left in
> build/artifacts/jdk1.5/lcrypto-jdk15on-150/classes and can be jarred
> up from there.
>
> If you want to build the PGP stuff you'll also need to add mail.jar to
> the classpath.
>
> Cheers,
> Michael
>
> ================
>
> #!/bin/bash
>
> dirs=(ant core docs jce mail pg pkix prov)
>
> for file in `find ${dirs[@]} -name bouncycastle`
> do
>         path=`dirname $file`
>         echo "Moving $file to $path/spongycastle"
>         mv $file $path/spongycastle
> done
>
> for file in `grep -Rl bouncycastle ${dirs[@]}`
> do
>         echo "Replacing string bouncycastle in $file"
>         sed -i 's/bouncycastle/spongycastle/g' $file
> done
>
> ================
>
> On 28/01/14 09:33, Daniele Ricci wrote:
>> Thank you Roberto! I was looking forward to this release.
>>
>> It would be great if the two project were merged... I mean
>> something like a script which "converts" all references to BC into
>> SC (I mean as an eventuality of all fixes by Roberto being merged
>> to BC).
>>
>> Keep up with the great work.
>>
>> On Mon, Jan 27, 2014 at 11:54 PM, Roberto Tyley
>> <[hidden email]> wrote:
>>> Release notes:
>>>
>>> https://github.com/rtyley/spongycastle/releases/tag/sc-v1.50.0.0
>>>
>>> This is the first release of Spongy Castle completed since Bouncy
>>> Castle a) started using Git, and b) introduced a Gradle build.
>>> Both those things are great, and make the task of releasing
>>> Spongy Castle substantially easier for me, but it's still taken
>>> several weeks of spare-time hacking to get a working 1.50 release
>>> - and that's *just* to patch the Bouncy Castle codebase to the
>>> point where the Gradle build completes and passes tests. Many of
>>> these changes have been submitted back to the Bouncy Castle
>>> project as half-dozen-or-so pull-requests, and I'd be grateful if
>>> they could be merged back into the project so that others can get
>>> the benefit of those fixes:
>>>
>>> https://github.com/bcgit/bc-java/pulls/rtyley
>>>
>>> Beyond that, it would be very helpful if the Bouncy Castle
>>> project could take up use of a continuous-integration service
>>> like Travis CI, to ensure that the Gradle build isn't broken
>>> again.
>>>
>>> As an example, I use a free Travis continuous-integration build
>>> for Spongy Castle, you can see the (very simple) definition file
>>> here:
>>>
>>> https://github.com/rtyley/spongycastle/blob/d3cab6b1/.travis.yml
>>>
>>> ...and here's the travis-ci build report against the most recent
>>> release of Spongy Castle:
>>>
>>> https://travis-ci.org/rtyley/spongycastle/builds/17661074
>>>
>>> It's possible to get BC to a reliable, simple, no-config-required
>>> build that any developer can check out and start working with
>>> immediately - it would be great if we could get there.
>>>
>>> best regards, Roberto Tyley
>>
>>
>>
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.10 (GNU/Linux)
>
> iQEcBAEBCgAGBQJS59P6AAoJEBEET9GfxSfMCQQH/0Zy6KA+hGjpb+TydJsCh8da
> QbrHzVm3CpiJdtxpfvZhDYl5bwfjrenjmY57bi7kES8mrOlpYGD/8sygiLmbHma6
> 0Dhh43Gyg+pCUa/ltMUoHk2kwfiLLYa42A+jm6NwOjaIM64a/IAN9jnhIARGWWhj
> 1BCQnkGJqbVu+ZiGJqf8+63k64b9Xlu+MDud98aLd6tLFJIx9UJPRNo/mSN2gKAd
> 6u1LDbGHrak/77lApIZkBcnB3K4Qd5DmNU0bqk0iDeHhIkXQOwOhFx/kuDLapAmp
> L4GA1wQ9t6CW7Z0rW7WVYPfwTp9XzSFIAHAba6Ct2ieuumsHM1NRWiS+LwFxd9s=
> =roUD
> -----END PGP SIGNATURE-----

--
Daniele

[Roberto Tyley-2]

On 28 January 2014 16:13, Michael Rogers <[hidden email]> wrote:

On 28/01/14 16:06, Matthew Hall wrote:
> A script called something like make_spongy exists in the
> SpongyCastle code which does the trick. ;)

That script seems to have disappeared in recent versions, which is why
I wrote my own. :-)

You can see the Spongy Castle transformation script here:

https://github.com/rtyley/spongycastle/blob/spongy-scripts/become-spongy.sh

Every time I do a build of Spongy Castle, the transformation commit includes the commit id of the version of the script that was used to produce the transformation:

https://github.com/rtyley/spongycastle/commit/9a2b105b

The script was probably less visible recently due to shifting of the Spongy Castle GitHub repo:

https://github.com/rtyley/spongycastle-old/blob/legacy-repo/README.md

Writing the script isn't really the hard part - the hard part is that I want to be sure that nothing has been broken by the transformation, which requires running the full Bouncy Castle test-suite - and I've already mentioned the issues I had around that.

best regards,

Roberto