maven jsign fail since bcutil-lts8on 2.73.8 release

[nbourdais]

Hi,

for your information, our build maven failed to sign an artifact today with this error :
java.lang.NoSuchMethodError: 'void org.bouncycastle.asn1.DERSequence.<init>(org.bouncycastle.asn1.ASN1Encodable, org.bouncycastle.asn1.ASN1Encodable)'
It turns out that jsign-maven-plugin depends on jsign-crypto which depends on bcpkix-lts8on which depends on bcutil-lts8on.
jsign has a fixed version for bouncy castle : 2.73.7 but bcutil-lts8on dependency is transitive and its version is fixed by bcpkix which depends on [2.73.7,2.74.0)
So when BC released bcutil-lts8on 2.73.8 today jsign-maven-plugin began to use the new version, but still the old versions of bcpkix et al.

We fixed bcutil-lts8on to 2.73.7 in our build to fix the error.
I guess fixing each bc dependency to 2.73.8 would work as well.

[ebourg]

Thank you for reporting this issue, there is indeed a version mismatch:

[INFO] --------------------< net.jsign:jsign-maven-plugin >--------------------
[INFO] Building Jsign - Authenticode signing in Java (Maven Plugin) 7.2-SNAPSHOT [7/8]
[INFO]   from jsign-maven-plugin\pom.xml
[INFO] ----------------------------[ maven-plugin ]----------------------------
[INFO]
[INFO] --- dependency:3.7.0:tree (default-cli) @ jsign-maven-plugin ---
[INFO] net.jsign:jsign-maven-plugin:maven-plugin:7.2-SNAPSHOT
[INFO] +- net.jsign:jsign-core:jar:7.2-SNAPSHOT:compile
[INFO] |  +- net.jsign:jsign-crypto:jar:7.2-SNAPSHOT:compile
[INFO] |  |  +- org.bouncycastle:bcprov-lts8on:jar:2.73.7:compile
[INFO] |  |  +- org.bouncycastle:bcpkix-lts8on:jar:2.73.7:compile
[INFO] |  |  |  \- org.bouncycastle:bcutil-lts8on:jar:2.73.8:compile

I'll set the dependency on bcutil-lts8on explicitly, but that's also a bug in Bouncy Castle's POM, because they shouldn't use a version range if the range isn't guaranteed to be binary compatible.

[craigalansmith]

@nbourdais, I have the same problem but so far have failed to fix the version in the build. Could you share how exactly you fixed the version of bcutil-lts8on to 2.73.7?

[ebourg]

See #321 for the workaround

[nbourdais]

We did as sratz in #321 : we added a <dependencies/> block in <plugin/> which declares jsign-maven-plugin, but only with bcutils

<plugin>
	<groupId>net.jsign</groupId>
	<artifactId>jsign-maven-plugin</artifactId>
(...)
	<executions>
(...)
	</executions>
	<dependencies>
		<dependency>
			<groupId>org.bouncycastle</groupId>
			<artifactId>bcutil-lts8on</artifactId>
			<version>2.73.7</version>
		</dependency>
	</dependencies>
</plugin>

[ebourg]

Jsign 7.2 has been released with the dependency update fixing this issue.

[craigalansmith]

Thank you 👍