-
Bug
-
Resolution: Done
-
Blocker
-
3.1.2.ER1
-
False
-
None
-
False
-
+
-
---
-
-
There are signed bouncycastle JARs in the repo
org/bouncycastle/bcutil-jdk18on/1.73.0.redhat-00001/bcutil-jdk18on-1.73.0.redhat-00001.jar org/bouncycastle/bcprov-jdk18on/1.73.0.redhat-00001/bcprov-jdk18on-1.73.0.redhat-00001.jar org/bouncycastle/bcpkix-jdk18on/1.73.0.redhat-00001/bcpkix-jdk18on-1.73.0.redhat-00001.jar
which are not listed in Marete exceptions for bc*-jdk15on
- bcmail-jdk15on-*.jar - bcprov-jdk15on-*.jar - bcpkix-jdk15on-*.jar - bcutil-jdk15on-*.jar
The original exceptions were added by https://gitlab.cee.redhat.com/rhoar-qe/marete/-/merge_requests/167 and refer to https://issues.redhat.com/browse/JBEAP-3550.
In upstream 3.0.0.Alph4, the bc*-jdk15on were replaced with bc*-jdk18on: https://github.com/quarkusio/quarkus/pull/30552.
So it may be possible that we should just add exceptions for bc*-jdk18on as well.
Test results:
- https://main-jenkins-csb-quarkusqe.apps.ocp-c1.prod.psi.redhat.com/view/Acceptance%203.2/job/rhbq-3.2-rhel8-jdk17-marete-ts/1/testReport/org.jboss.qa.marete/MavenRepoTest/jarsAreNotSigned/
- https://main-jenkins-csb-quarkusqe.apps.ocp-c1.prod.psi.redhat.com/view/Acceptance%203.2/job/rhbq-3.2-rhel8-jdk17-marete-ts/1/testReport/org.jboss.qa.marete/MavenRepoTest/jarsAreNotSigned_2/
- https://main-jenkins-csb-quarkusqe.apps.ocp-c1.prod.psi.redhat.com/view/Acceptance%203.2/job/rhbq-3.2-rhel8-jdk17-marete-ts/1/testReport/org.jboss.qa.marete/MavenRepoTest/jarsAreNotSigned_3/
- links to
-
RHSA-2023:120897 Red Hat build of Quarkus 3.2.6 release and security update