Skip to content

Conversation

exceptionfactory
Copy link
Contributor

@exceptionfactory exceptionfactory commented Mar 20, 2025

This pull request assigns Bouncy Castle dependencies to the bouncyCastle feature variant in the Gradle build. Assigning these dependencies to a variant results in marking the libraries as optional dependencies in the published Maven configuration.

This change builds on recent efforts to move away from and isolate use of the Bouncy Castle library throughout the project.

This could be considered a breaking change for consumers that rely on inclusion of Bouncy Castle as a transitive dependency and require features that Bouncy Castle provides.

Direct features include reading PEM key files encrypted using historical methods other than PKCS8, and reading PuTTY Key Version 3 files that require the Argon2 key derivation function. Indirect features that depend on the Bouncy Castle security provider include support for Ed25519 when running on Java 14 or earlier, and support for X25519 when running on Java 10 or earlier. All of these features will continue to work when Bouncy Castle dependencies are declared directly.

The alternative to this change is retaining the current dependency requirements, and requiring consumers to exclude the Bouncy Castle transitive dependencies.

@hierynomus
Copy link
Owner

I'll keep this one on the backlog for a moment. There's a ton of other changes pending, let's get them out first. This might warrant a slightly bigger version jump.

@exceptionfactory
Copy link
Contributor Author

Thanks @hierynomus, I agree that this change has a larger potential impact and could warrant a major version adjustment. Revisiting this later after other incremental releases sounds good!

- Added bouncyCastle feature for marking Bouncy Castle libraries as optional
@exceptionfactory exceptionfactory force-pushed the bouncy-castle-feature-1 branch from f58a17f to 1512c6e Compare August 16, 2025 16:37
@exceptionfactory
Copy link
Contributor Author

@hierynomus Do you have any additional thoughts on the feature variant approach proposed, making Bouncy Castle and optional dependency? If you would prefer to keep the current approach, I can close this one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants