Fix Server Startup issues in FIPS compliant mode due to not having Bouncy Castle jars#4570
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe pull request downgrades 23 Equinox P2 component version properties in Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
PR builder started |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@core/org.wso2.carbon.core/pom.xml`:
- Around line 261-263: The pom import entries for Bouncy Castle are
inconsistent: locate every occurrence of the package import pattern
"org.bouncycastle.*" (and any bouncycastle wildcard entries like
"org.bouncycastle.jcajce.*") across the startup bundles' pom.xml files and
append ;resolution:=optional to each import entry so they match the fixed line
(e.g. change "org.bouncycastle.*; version=\"...\"" to include
";resolution:=optional"); ensure all startup bundle import lists (including the
ones reported around the other bundles) are updated consistently so no mandatory
BC imports remain.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro
Run ID: 4ced35c2-6e9c-42a0-82c7-088c7b29e74f
📒 Files selected for processing (2)
core/org.wso2.carbon.core/pom.xmlparent/pom.xml
| org.bouncycastle.jcajce.*; version="${imp.pkg.version.bcp}"; resolution:=optional, | ||
| org.bouncycastle.*; version="${imp.pkg.version.bcp}", | ||
| org.bouncycastle.*; version="${imp.pkg.version.bcp}"; resolution:=optional, | ||
| *;resolution:=optional |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Find remaining mandatory Bouncy Castle Import-Package entries.
fd -a pom.xml -x rg -nP -C2 'org\.bouncycastle(?:\.jcajce)?\.\*; version="\$\{imp\.pkg\.version\.bcp\}"(?!;\s*resolution:=optional)' {}Repository: wso2/carbon-kernel
Length of output: 899
🏁 Script executed:
fd -a pom.xml -x rg -nP -C2 'org\.bouncycastle(?:\.jcajce)?\.\*; version="\$\{imp\.pkg\.version\.bcp\}"(?!;\s*resolution:=optional)' {}Repository: wso2/carbon-kernel
Length of output: 899
Add resolution:=optional to remaining mandatory Bouncy Castle imports across all startup bundles.
The fix applied to line 262 of this file is incomplete. Mandatory org.bouncycastle.* imports without resolution:=optional remain in other bundles (lines 300 and 125 detected). Without propagating this fix, a runtime omitting classic BC bundles will still encounter OSGi wiring failures during startup.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@core/org.wso2.carbon.core/pom.xml` around lines 261 - 263, The pom import
entries for Bouncy Castle are inconsistent: locate every occurrence of the
package import pattern "org.bouncycastle.*" (and any bouncycastle wildcard
entries like "org.bouncycastle.jcajce.*") across the startup bundles' pom.xml
files and append ;resolution:=optional to each import entry so they match the
fixed line (e.g. change "org.bouncycastle.*; version=\"...\"" to include
";resolution:=optional"); ensure all startup bundle import lists (including the
ones reported around the other bundles) are updated consistently so no mandatory
BC imports remain.
|
PR builder completed |
jenkins-is-staging
left a comment
jenkins-is-staging
left a comment
There was a problem hiding this comment.
Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/24026562857
|
PR builder started |
|
PR builder completed |
jenkins-is-staging
left a comment
jenkins-is-staging
left a comment
There was a problem hiding this comment.
Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/24028159865
|
Executed Integration Tests Against Java25 as well and following are the results. 
Manually run the action rekated flows which was failed during the test and those flows are working without any issue. |
Aligns Equinox P2 dependency versions with wso2/carbon-kernel#4570, which fixes server startup failures in FIPS-compliant mode caused by incompatible Bouncy Castle jar versions introduced by newer P2 jars.
3 participants
Purpose
Fix Server Startup issues in FIPS compliant mode due to not having Bouncy Castle jars
Related Issue: Server start fails when FIPS mode is enabled product-is#27333
Goals
Approach
User stories
Release note
Documentation
Training
Certification
Marketing
Automation tests
Security checks
Samples
Related PRs
Migrations (if applicable)
Test environment
Learning