From e0f8a513f98fd9f490b1742e53d05b20cab18e7a Mon Sep 17 00:00:00 2001
From: Richard Dennehy <richard.dennehy@elastic.co>
Date: Thu, 21 Aug 2025 09:56:29 +0100
Subject: [PATCH] bump bcpkix version (#132853)

(cherry picked from commit 049d1f3f344bbdd2b9c8a00308bee751b3d801d5)
---
 build-tools-internal/version.properties           |  2 +-
 docs/changelog/132853.yaml                        |  5 +++++
 gradle/verification-metadata.xml                  | 15 +++++++++++++++
 .../packaging/test/ArchiveTests.java              |  8 ++++----
 4 files changed, 25 insertions(+), 5 deletions(-)
 create mode 100644 docs/changelog/132853.yaml

diff --git a/build-tools-internal/version.properties b/build-tools-internal/version.properties
index 24fa4f4a9536c..407a607a175f6 100644
--- a/build-tools-internal/version.properties
+++ b/build-tools-internal/version.properties
@@ -23,7 +23,7 @@ reactive_streams    = 1.0.4
 
 antlr4            = 4.13.1
 # bouncy castle version for non-fips. fips jars use a different version
-bouncycastle=1.78.1
+bouncycastle=1.79
 # used by security and idp (need to be in sync due to cross-dependency in testing)
 opensaml = 4.3.0
 
diff --git a/docs/changelog/132853.yaml b/docs/changelog/132853.yaml
new file mode 100644
index 0000000000000..ee60d04bbd3a8
--- /dev/null
+++ b/docs/changelog/132853.yaml
@@ -0,0 +1,5 @@
+pr: 132853
+summary: Bump bcpkix version
+area: Security
+type: upgrade
+issues: []
diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml
index 408aff63d0961..0c3aae3b5802f 100644
--- a/gradle/verification-metadata.xml
+++ b/gradle/verification-metadata.xml
@@ -3356,6 +3356,11 @@
             <sha256 value="4b48ea084e5232b9d79ebca1887b9de037b124931807cd60710748c2aee08cc9" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.bouncycastle" name="bcpkix-jdk18on" version="1.79">
+         <artifact name="bcpkix-jdk18on-1.79.jar">
+            <sha256 value="3639a24ddf9ba4b7eba0659b44770e91eba816421888e571f285aadefe532cd6" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.bouncycastle" name="bcprov-jdk15on" version="1.60">
          <artifact name="bcprov-jdk15on-1.60.jar">
             <sha256 value="7f1a0e6badab38666f8467a9a0ee96656b2f8ec8623867ed34f3cdc173b7ee07" origin="Generated by Gradle"/>
@@ -3371,6 +3376,11 @@
             <sha256 value="add5915e6acfc6ab5836e1fd8a5e21c6488536a8c1f21f386eeb3bf280b702d7" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.bouncycastle" name="bcprov-jdk18on" version="1.79">
+         <artifact name="bcprov-jdk18on-1.79.jar">
+            <sha256 value="0d81ecc3124536b539bce9aa3fe9621b7f84c9cee371b635a5b31c78b79ab1da" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.bouncycastle" name="bctls-fips" version="1.0.19">
          <artifact name="bctls-fips-1.0.19.jar">
             <sha256 value="a0bbad2eb5268f1baa08f0e2e69cb61cd292e19e73595c620d586d335d97d1a8" origin="Generated by Gradle"/>
@@ -3381,6 +3391,11 @@
             <sha256 value="d9fa56f97b0f761ce3bc8d9d74c5d7137a987bf5bd3abfe1003f9bafa45a1d2f" origin="Generated by Gradle"/>
          </artifact>
       </component>
+      <component group="org.bouncycastle" name="bcutil-jdk18on" version="1.79">
+         <artifact name="bcutil-jdk18on-1.79.jar">
+            <sha256 value="c70b88ada58938cbc2f005d40329054078bcfa1149e6ffc03e9242eb6ab21836" origin="Generated by Gradle"/>
+         </artifact>
+      </component>
       <component group="org.carrot2" name="morfologik-fsa" version="2.1.1">
          <artifact name="morfologik-fsa-2.1.1.jar">
             <sha256 value="c91db33831762a305d6d30fbd4230d9e57798706e25c35222c9bee1eb3e00109" origin="Generated by Gradle"/>
diff --git a/qa/packaging/src/test/java/org/elasticsearch/packaging/test/ArchiveTests.java b/qa/packaging/src/test/java/org/elasticsearch/packaging/test/ArchiveTests.java
index 14178e84969ed..6bcd17a94c1d8 100644
--- a/qa/packaging/src/test/java/org/elasticsearch/packaging/test/ArchiveTests.java
+++ b/qa/packaging/src/test/java/org/elasticsearch/packaging/test/ArchiveTests.java
@@ -212,14 +212,14 @@ public void test50AutoConfigurationFailsWhenCertificatesNotGenerated() throws Ex
         FileUtils.assertPathsDoNotExist(installation.data);
         Path tempDir = createTempDir("bc-backup");
         Files.move(
-            installation.lib.resolve("tools").resolve("security-cli").resolve("bcprov-jdk18on-1.78.1.jar"),
-            tempDir.resolve("bcprov-jdk18on-1.78.1.jar")
+            installation.lib.resolve("tools").resolve("security-cli").resolve("bcprov-jdk18on-1.79.jar"),
+            tempDir.resolve("bcprov-jdk18on-1.79.jar")
         );
         Shell.Result result = runElasticsearchStartCommand(null, false, false);
         assertElasticsearchFailure(result, "java.lang.NoClassDefFoundError: org/bouncycastle/", null);
         Files.move(
-            tempDir.resolve("bcprov-jdk18on-1.78.1.jar"),
-            installation.lib.resolve("tools").resolve("security-cli").resolve("bcprov-jdk18on-1.78.1.jar")
+            tempDir.resolve("bcprov-jdk18on-1.79.jar"),
+            installation.lib.resolve("tools").resolve("security-cli").resolve("bcprov-jdk18on-1.79.jar")
         );
         Platforms.onWindows(() -> sh.chown(installation.config));
         FileUtils.rm(tempDir);