Skip to content

Commit 118c137

Browse files
BinduSri-6522866BinduSri-6522866
committed
Upgrade trilead-ssh2 version to 217.293
1 parent 21b8a73 commit 118c137

17 files changed

+1020
-21
lines changed

‎LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎LICENSES-AND-NOTICES/SPECS/data/licenses.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2585,6 +2585,7 @@
25852585
"cpulimit",
25862586
"cri-o",
25872587
"ecj",
2588+
"ed25519-java",
25882589
"fillup",
25892590
"flux",
25902591
"gd",
@@ -2607,6 +2608,7 @@
26072608
"javacc",
26082609
"javacc-bootstrap",
26092610
"javassist",
2611+
"jbcrypt",
26102612
"jboss-interceptors-1.2-api",
26112613
"jdepend",
26122614
"jflex",

‎SPECS-EXTENDED/ed25519-java/0001-EdDSAEngine.initVerify-Handle-any-non-EdDSAPublicKey.patch‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From c5629faa3e1880cc71da506263f224bc818fe827 Mon Sep 17 00:00:00 2001
2+
From: Jack Grigg <thestr4d@gmail.com>
3+
Date: Sun, 27 Jan 2019 23:27:00 +0000
4+
Subject: [PATCH 1/2] EdDSAEngine.initVerify(): Handle any non-EdDSAPublicKey
5+
X.509-encoded pubkey
6+
7+
sun.security.x509.X509Key is a JDK-internal API, and should not be used
8+
directly. Instead of looking for an instance of that class, we check the
9+
primary encoding format of the PublicKey, and proceed if it is "X.509".
10+
---
11+
src/net/i2p/crypto/eddsa/EdDSAEngine.java | 3 +--
12+
1 file changed, 1 insertion(+), 2 deletions(-)
13+
14+
diff --git a/src/net/i2p/crypto/eddsa/EdDSAEngine.java b/src/net/i2p/crypto/eddsa/EdDSAEngine.java
15+
index 1f0ba6d..6b25410 100644
16+
--- a/src/net/i2p/crypto/eddsa/EdDSAEngine.java
17+
+++ b/src/net/i2p/crypto/eddsa/EdDSAEngine.java
18+
@@ -29,7 +29,6 @@ import java.util.Arrays;
19+
import net.i2p.crypto.eddsa.math.Curve;
20+
import net.i2p.crypto.eddsa.math.GroupElement;
21+
import net.i2p.crypto.eddsa.math.ScalarOps;
22+
-import sun.security.x509.X509Key;
23+
24+
/**
25+
* Signing and verification for EdDSA.
26+
@@ -157,7 +156,7 @@ public final class EdDSAEngine extends Signature {
27+
}
28+
} else if (!key.getParams().getHashAlgorithm().equals(digest.getAlgorithm()))
29+
throw new InvalidKeyException("Key hash algorithm does not match chosen digest");
30+
- } else if (publicKey instanceof X509Key) {
31+
+ } else if (publicKey.getFormat().equals("X.509")) {
32+
// X509Certificate will sometimes contain an X509Key rather than the EdDSAPublicKey itself; the contained
33+
// key is valid but needs to be instanced as an EdDSAPublicKey before it can be used.
34+
EdDSAPublicKey parsedPublicKey;
35+
--
36+
2.33.1
37+

‎SPECS-EXTENDED/ed25519-java/0002-Disable-test-that-relies-on-internal-sun-JDK-classes.patch‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
From 1ea7fb5ed949d8a458fda40b186868b7cffbb271 Mon Sep 17 00:00:00 2001
2+
From: Mat Booth <mat.booth@gmail.com>
3+
Date: Wed, 1 Dec 2021 09:35:10 +0000
4+
Subject: [PATCH 2/2] Disable test that relies on internal sun JDK classes
5+
6+
---
7+
test/net/i2p/crypto/eddsa/EdDSAEngineTest.java | 18 ------------------
8+
1 file changed, 18 deletions(-)
9+
10+
diff --git a/test/net/i2p/crypto/eddsa/EdDSAEngineTest.java b/test/net/i2p/crypto/eddsa/EdDSAEngineTest.java
11+
index 2ed793b..adc46fd 100644
12+
--- a/test/net/i2p/crypto/eddsa/EdDSAEngineTest.java
13+
+++ b/test/net/i2p/crypto/eddsa/EdDSAEngineTest.java
14+
@@ -31,8 +31,6 @@ import net.i2p.crypto.eddsa.spec.EdDSAPublicKeySpec;
15+
import org.junit.Rule;
16+
import org.junit.Test;
17+
import org.junit.rules.ExpectedException;
18+
-import sun.security.util.DerValue;
19+
-import sun.security.x509.X509Key;
20+
21+
/**
22+
* @author str4d
23+
@@ -217,20 +215,4 @@ public class EdDSAEngineTest {
24+
assertThat("verifyOneShot() failed", sgr.verifyOneShot(TEST_MSG, TEST_MSG_SIG), is(true));
25+
}
26+
27+
- @Test
28+
- public void testVerifyX509PublicKeyInfo() throws Exception {
29+
- EdDSAParameterSpec spec = EdDSANamedCurveTable.getByName("Ed25519");
30+
- Signature sgr = new EdDSAEngine(MessageDigest.getInstance(spec.getHashAlgorithm()));
31+
- for (Ed25519TestVectors.TestTuple testCase : Ed25519TestVectors.testCases) {
32+
- EdDSAPublicKeySpec pubKey = new EdDSAPublicKeySpec(testCase.pk, spec);
33+
- PublicKey vKey = new EdDSAPublicKey(pubKey);
34+
- PublicKey x509Key = X509Key.parse(new DerValue(vKey.getEncoded()));
35+
- sgr.initVerify(x509Key);
36+
-
37+
- sgr.update(testCase.message);
38+
-
39+
- assertThat("Test case " + testCase.caseNum + " failed",
40+
- sgr.verify(testCase.sig), is(true));
41+
- }
42+
- }
43+
}
44+
--
45+
2.33.1
46+

‎SPECS-EXTENDED/ed25519-java/ed25519-java-CVE-2020-36843.patch‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
--- ed25519-java-0.3.0/src/net/i2p/crypto/eddsa/EdDSAEngine.java 2025-03-14 14:47:43.404137953 +0100
2+
+++ ed25519-java-0.3.0/src/net/i2p/crypto/eddsa/EdDSAEngine.java 2025-03-14 14:50:31.859888550 +0100
3+
@@ -12,6 +12,7 @@
4+
package net.i2p.crypto.eddsa;
5+
6+
import java.io.ByteArrayOutputStream;
7+
+import java.math.BigInteger;
8+
import java.nio.ByteBuffer;
9+
import java.security.InvalidAlgorithmParameterException;
10+
import java.security.InvalidKeyException;
11+
@@ -29,6 +30,7 @@
12+
import net.i2p.crypto.eddsa.math.Curve;
13+
import net.i2p.crypto.eddsa.math.GroupElement;
14+
import net.i2p.crypto.eddsa.math.ScalarOps;
15+
+import net.i2p.crypto.eddsa.math.bigint.BigIntegerLittleEndianEncoding;
16+
17+
/**
18+
* Signing and verification for EdDSA.
19+
@@ -69,6 +71,8 @@
20+
public final class EdDSAEngine extends Signature {
21+
public static final String SIGNATURE_ALGORITHM = "NONEwithEdDSA";
22+
23+
+ private static final BigInteger ORDER = new BigInteger("2").pow(252).add(new BigInteger("27742317777372353535851937790883648493"));
24+
+
25+
private MessageDigest digest;
26+
private ByteArrayOutputStream baos;
27+
private EdDSAKey key;
28+
@@ -306,6 +310,11 @@
29+
h = key.getParams().getScalarOps().reduce(h);
30+
31+
byte[] Sbyte = Arrays.copyOfRange(sigBytes, b/8, b/4);
32+
+ // RFC 8032
33+
+ BigInteger Sbigint = (new BigIntegerLittleEndianEncoding()).toBigInteger(Sbyte);
34+
+ if (Sbigint.compareTo(ORDER) >= 0)
35+
+ return false;
36+
+
37+
// R = SB - H(Rbar,Abar,M)A
38+
GroupElement R = key.getParams().getB().doubleScalarMultiplyVariableTime(
39+
((EdDSAPublicKey) key).getNegativeA(), h, Sbyte);

‎SPECS-EXTENDED/ed25519-java/ed25519-java-build.xml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
3+
<project name="eddsa" default="package" basedir=".">
4+
5+
<!-- ====================================================================== -->
6+
<!-- Build environment properties -->
7+
<!-- ====================================================================== -->
8+
9+
<property name="compiler.release" value="8"/>
10+
<property name="compiler.source" value="1.${compiler.release}"/>
11+
<property name="compiler.target" value="${compiler.source}"/>
12+
13+
<property name="project.groupId" value="net.i2p.crypto"/>
14+
<property name="project.artifactId" value="eddsa"/>
15+
<property name="project.version" value="0.3.0"/>
16+
17+
<property name="build.finalName" value="${project.artifactId}-${project.version}"/>
18+
<property name="build.dir" value="target"/>
19+
<property name="build.outputDir" value="${build.dir}/classes"/>
20+
<property name="build.srcDir" value="src"/>
21+
22+
<property name="reporting.outputDirectory" value="${build.dir}/site"/>
23+
24+
<!-- ====================================================================== -->
25+
<!-- Cleaning up target -->
26+
<!-- ====================================================================== -->
27+
28+
<target name="clean" description="Clean the output directory">
29+
<delete dir="${build.dir}"/>
30+
</target>
31+
32+
<!-- ====================================================================== -->
33+
<!-- Compilation target -->
34+
<!-- ====================================================================== -->
35+
36+
<target name="compile" description="Compile the code">
37+
<mkdir dir="${build.outputDir}"/>
38+
<javac destdir="${build.outputDir}"
39+
encoding="UTF-8"
40+
nowarn="false"
41+
debug="true"
42+
optimize="false"
43+
deprecation="true"
44+
release="${compiler.release}"
45+
target="${compiler.target}"
46+
verbose="false"
47+
fork="false"
48+
source="${compiler.source}">
49+
<src>
50+
<pathelement location="${build.srcDir}"/>
51+
</src>
52+
</javac>
53+
</target>
54+
55+
<!-- ====================================================================== -->
56+
<!-- Javadoc target -->
57+
<!-- ====================================================================== -->
58+
59+
<target name="javadoc" description="Generates the Javadoc of the application">
60+
<javadoc sourcepath="${build.srcDir}"
61+
packagenames="*"
62+
destdir="${reporting.outputDirectory}/apidocs"
63+
access="protected"
64+
encoding="UTF-8"
65+
source="${compiler.source}"
66+
verbose="false"
67+
version="true"
68+
use="true"
69+
author="true"
70+
splitindex="false"
71+
nodeprecated="false"
72+
nodeprecatedlist="false"
73+
notree="false"
74+
noindex="false"
75+
nohelp="false"
76+
nonavbar="false"
77+
serialwarn="false"
78+
linksource="false"
79+
breakiterator="false"/>
80+
</target>
81+
82+
<!-- ====================================================================== -->
83+
<!-- Package target -->
84+
<!-- ====================================================================== -->
85+
86+
<target name="package" depends="compile" description="Package the application">
87+
<jar jarfile="${build.dir}/${build.finalName}.jar"
88+
compress="true"
89+
index="false"
90+
basedir="${build.outputDir}"
91+
excludes="**/package.html">
92+
<manifest>
93+
<attribute name="Automatic-Module-Name" value="${project.groupId}.${project.artifactId}"/>
94+
<attribute name="Bundle-Description" value="Implementation of EdDSA in Java"/>
95+
<attribute name="Bundle-License" value="https://creativecommons.org/publicdomain/zero/1.0/"/>
96+
<attribute name="Bundle-ManifestVersion" value="2"/>
97+
<attribute name="Bundle-Name" value="EdDSA-Java"/>
98+
<attribute name="Bundle-SymbolicName" value="${project.groupId}.${project.artifactId}"/>
99+
<attribute name="Bundle-Version" value="${project.version}"/>
100+
<attribute name="Export-Package" value="net.i2p.crypto.eddsa.spec;version=&quot;${project.version}&quot;,net.i2p.crypto.eddsa;uses:=&quot;net.i2p.crypto.eddsa.spec&quot;;version=&quot;${project.version}&quot;"/>
101+
<attribute name="Import-Package" value="sun.security.x509;resolution:=optional"/>
102+
<attribute name="JavaPackages-ArtifactId" value="${project.artifactId}"/>
103+
<attribute name="JavaPackages-GroupId" value="${project.groupId}"/>
104+
<attribute name="JavaPackages-Version" value="${project.version}"/>
105+
<attribute name="Require-Capability" value="osgi.ee;filter:=&quot;(&amp;(osgi.ee=JavaSE)(version=${compiler.target}))&quot;"/>
106+
</manifest>
107+
</jar>
108+
</target>
109+
110+
<!-- ====================================================================== -->
111+
<!-- A dummy target for the package named after the type it creates -->
112+
<!-- ====================================================================== -->
113+
114+
<target name="jar" depends="package" description="Builds the jar for the application"/>
115+
116+
</project>

‎SPECS-EXTENDED/ed25519-java/ed25519-java.signatures.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"Signatures": {
3+
"ed25519-java-0.3.0.tar.gz": "a89a2331afb1db0bd06ce029c731db2d24684cebf111e796b51deb6e2a20a310",
4+
"ed25519-java-build.xml": "2eb416752ef86be27a06581dfb60c6c4693d530ffa7f8e12f28112b40d65fab7"
5+
}
6+
}

‎SPECS-EXTENDED/ed25519-java/ed25519-java.spec‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
Vendor: Microsoft Corporation
2+
Distribution: Azure Linux
3+
#
4+
# spec file for package ed25519-java
5+
#
6+
# Copyright (c) 2025 SUSE LLC
7+
#
8+
# All modifications and additions to the file contributed by third parties
9+
# remain the property of their copyright owners, unless otherwise agreed
10+
# upon. The license for this file, and modifications and additions to the
11+
# file, is the same license as for the pristine package itself (unless the
12+
# license for the pristine package is not an Open Source License, in which
13+
# case the license is the MIT License). An "Open Source License" is a
14+
# license that conforms to the Open Source Definition (Version 1.9)
15+
# published by the Open Source Initiative.
16+
17+
# Please submit bugfixes or comments via https://bugs.opensuse.org/
18+
#
19+
20+
21+
%global artifactId eddsa
22+
Name: ed25519-java
23+
Version: 0.3.0
24+
Release: 1%{?dist}
25+
Summary: Implementation of EdDSA (Ed25519) in Java
26+
License: CC0-1.0
27+
URL: https://github.com/str4d/ed25519-java
28+
Source0: https://github.com/str4d/ed25519-java/archive/v%{version}/%{name}-%{version}.tar.gz
29+
Source1: %{name}-build.xml
30+
Patch0: 0001-EdDSAEngine.initVerify-Handle-any-non-EdDSAPublicKey.patch
31+
Patch1: 0002-Disable-test-that-relies-on-internal-sun-JDK-classes.patch
32+
Patch2: %{name}-CVE-2020-36843.patch
33+
BuildRequires: ant
34+
BuildRequires: fdupes
35+
BuildRequires: java-devel >= 1.8
36+
BuildRequires: javapackages-local-bootstrap >= 6
37+
BuildRequires: javapackages-tools
38+
BuildArch: noarch
39+
40+
%description
41+
This is an implementation of EdDSA in Java. Structurally, it
42+
is based on the ref10 implementation in SUPERCOP (see
43+
http://ed25519.cr.yp.to/software.html).
44+
45+
There are two internal implementations:
46+
47+
* A port of the radix-2^51 operations in ref10
48+
- fast and constant-time, but only useful for Ed25519.
49+
* A generic version using BigIntegers for calculation
50+
- a bit slower and not constant-time, but compatible
51+
with any EdDSA parameter specification.
52+
53+
%package javadoc
54+
Summary: Javadoc for %{name}
55+
56+
%description javadoc
57+
This package contains javadoc for %{name}.
58+
59+
%prep
60+
%setup -q
61+
cp %{SOURCE1} build.xml
62+
%patch -P 0 -p1
63+
%patch -P 1 -p1
64+
%patch -P 2 -p1
65+
66+
%build
67+
ant jar javadoc
68+
69+
%install
70+
71+
# jar
72+
install -dm 0755 %{buildroot}%{_javadir}
73+
install -pm 0644 target/%{artifactId}-%{version}.jar %{buildroot}%{_javadir}/%{artifactId}.jar
74+
ln -sf %{_javadir}/%{artifactId}.jar %{buildroot}%{_javadir}/%{name}.jar
75+
76+
# pom
77+
install -dm 0755 %{buildroot}%{_mavenpomdir}
78+
install -pm 0644 pom.xml %{buildroot}%{_mavenpomdir}/%{artifactId}.pom
79+
%add_maven_depmap %{artifactId}.pom %{artifactId}.jar
80+
81+
# javadoc
82+
install -dm 0755 %{buildroot}%{_javadocdir}/%{name}
83+
cp -r target/site/apidocs/* %{buildroot}%{_javadocdir}/%{name}/
84+
%fdupes -s %{buildroot}%{_javadocdir}
85+
86+
%files -f .mfiles
87+
%{_javadir}/%{name}.jar
88+
%doc README.md
89+
%license LICENSE.txt
90+
91+
%files javadoc
92+
%{_javadocdir}/%{name}
93+
%license LICENSE.txt
94+
95+
%changelog
96+
* Tue Dec 16 2025 BinduSri Adabala <v-badabala@microsoft.com> - 0.3.0-1
97+
- Initial Azure Linux import from openSUSE Tumbleweed.
98+
- License verified
99+
100+
* Fri Mar 14 2025 Fridrich Strba <fstrba@suse.com>
101+
- Added patch:
102+
* ed25519-java-CVE-2020-36843.patch
103+
+ backport commit https://github.com/i2p/i2p.i2p/commit/
104+
/d7d1dcb5399c61cf2916ccc45aa25b0209c88712
105+
+ Fixes bsc#1239551, CVE-2020-36843: no check performed on
106+
scalar to avoid signature malleability
107+
* Wed Oct 30 2024 Fridrich Strba <fstrba@suse.com>
108+
- Rewrite the build using ant
109+
* Wed Feb 21 2024 Gus Kenion <gus.kenion@suse.com>
110+
- Use %%patch -P N instead of deprecated %%patchN.
111+
* Mon Sep 11 2023 Fridrich Strba <fstrba@suse.com>
112+
- Reproducible builds: use SOURCE_DATE_EPOCH for timestamp
113+
* Tue Mar 22 2022 Fridrich Strba <fstrba@suse.com>
114+
- Build with source and target levels 8
115+
- Added patches:
116+
* 0001-EdDSAEngine.initVerify-Handle-any-non-EdDSAPublicKey.patch
117+
* 0002-Disable-test-that-relies-on-internal-sun-JDK-classes.patch
118+
+ Remove use of internal sun JDK classes
119+
* Mon Jun 29 2020 Fridrich Strba <fstrba@suse.com>
120+
- Initial packaging of ed25519 0.3.0

0 commit comments

Comments
 (0)