ArmoredOutputStream showing v@RELEASE_NAME@

[younoknowme]

         public static byte[] encrypt(
            byte[]  clearData,
            char[]  passPhrase,
            String  fileName,
            int     algorithm,
            boolean armor)
            throws IOException, PGPException, NoSuchProviderException
        {
        if (fileName == null)
        {
            fileName= PGPLiteralData.CONSOLE;
        }  `
       
        byte[] compressedData = compress(clearData, fileName, CompressionAlgorithmTags.ZIP);

        ByteArrayOutputStream bOut = new ByteArrayOutputStream();

        OutputStream out = bOut;
        if (armor)
        {
            out = new ArmoredOutputStream(out);
        }

        JcePGPDataEncryptorBuilder encryptorBuilder = new JcePGPDataEncryptorBuilder(algorithm)
                .setSecureRandom(new SecureRandom()).setProvider("BC");

        PGPEncryptedDataGenerator encGen = new PGPEncryptedDataGenerator(encryptorBuilder);
        encGen.addMethod(new JcePBEKeyEncryptionMethodGenerator(passPhrase).setProvider("BC"));

        OutputStream encOut = encGen.open(out, compressedData.length);

        encOut.write(compressedData);
        encOut.close();

        if (armor)
        {
            out.close();
        }

        return bOut.toByteArray();
    }

    private static byte[] compress(byte[] clearData, String fileName, int algorithm) throws IOException
    {
        ByteArrayOutputStream bOut = new ByteArrayOutputStream();
        PGPCompressedDataGenerator comData = new PGPCompressedDataGenerator(algorithm);
        OutputStream cos = comData.open(bOut); // open it with the final destination

        PGPLiteralDataGenerator lData = new PGPLiteralDataGenerator();

        // we want to generate compressed data. This might be a user option later,
        // in which case we would pass in bOut.
        OutputStream  pOut = lData.open(cos, // the compressed output stream
                PGPLiteralData.BINARY,
                fileName,  // "filename" to store
                clearData.length, // length of clear data
                new Date()  // current time
        );

        pOut.write(clearData);
        pOut.close();

        comData.close();

        return bOut.toByteArray();
    }

public static void main(String[] args) throws IOException, PGPException, NoSuchProviderException {

 String passPhrase = "Dick Beck";
        char[] passArray = passPhrase.toCharArray();
        byte[] original = "Hello world".getBytes();
        System.out.println("Starting PGP test");
        byte[] encrypted = encrypt(original, passArray, "iway", PGPEncryptedDataGenerator.CAST5, true);
        System.out.println("\nencrypted data = '"+new String(encrypted)+"'");
    }

output:
encrypted data = 

'-----BEGIN PGP MESSAGE-----
Version: BCPG v@RELEASE_NAME@

ww0EAwMC04oCHn2+Qexg0jwBFShLDxhRNRs9eQUiCFOWSdqywdXDopTQubtGSpBk
kBvwWFJbWuxrIebzbXALaNsG+2QFP5NJ5FgL8AE=
=G7YN
-----END PGP MESSAGE-----'

How can I get rid of the v@RELEASE_NAME@ in this code or is this a bug? I'm using bcpg-jdk18on, bcprov-jdk18on, bcutil-jdk18on release 1.78.1

Do I need to explicitly set the version? Shouldn't it infer from the maven version?

[dghgit]

Yep, this is a bug - the 1.8 and later build is now built exclusively by gradle, the main reason being we need to use the OSGI plugin to support OSGI multi-release files. I'll admit it's a bit neater as well... anyway, seems this particular item got missed.

Have a look at https://downloads.bouncycastle.org/betas the version of bcpg should now report the correct string if you run:

import org.bouncycastle.bcpg.*;

public class Main 
{
    public static void main(String[] args)
       throws Exception
    {
       System.err.println(ArmoredOutputStream.DEFAULT_VERSION);
    }
}

Note: the trend now is to not report version information in the files directly as there are concerns the information makes it too easy to pick out vulnerable files. There is also an ArmoredOutputStream.Builder class which provides more control over the headers (this was added in 1.76 so you should find it works for you now). Any questions please let me know.

[mouse07410]

One big problem with your Gradle build is that it insists on having all the JDKs installed. Since my system is sane, it only has JDK-21 (and JDK-11 for truly weird cases).

Until that (i.e., insistence on having JDK-8) issue is resolved, I am stuck with Ant build process. Suspect there are many users in the same boat as me.

[dghgit]

Unfortunately "sourceCompatibility = 1.8" only means code level - it's still possible to call API that only exist in later JVMs if you do not ensure the boot class path is correct, although looking at all the changes required for OSGi, I think we may need to check that that is still always the case.

I haven't tried this, but I can't think of any reason the gradle build would not work if everything was set to point at Java 21 - Java 21 will produce byte code back to Java 8 and in your case the source code is already vetted (assuming you're not making any changes) so the bootclass path problem should not occur.

[theit]

Unfortunately "sourceCompatibility = 1.8" only means code level - it's still possible to call API that only exist in later JVMs if you do not ensure the boot class path is correct, although looking at all the changes required for OSGi, I think we may need to check that that is still always the case.

Yes, but only when you use "-source=1.8" (and/or "-target=1.8"). If you use the "--release=8" parameter instead when calling javac (available since Java 9) you can effectively prevent your code from using newer API methods that aren't available in earlier ones :-)

[dghgit]

Thanks. Cool! Will investigate.

[dghgit]

Okay, this is a bit of a divergence from the actual topic, but we've just pushed a new set of gradle files which will hopefully simplify things a bit.