[RHPAM-4734] [CVE-2023-33201] bouncycastle upgraded to 1.74 #2324

Ginxo · 2023-06-20T05:53:37Z

Thank you for submitting this pull request

JIRA:

https://issues.redhat.com/browse/RHPAM-4734

referenced Pull Requests: (please edit the URLs of referenced pullrequests if they exist)

How to replicate CI configuration locally?

Build Chain tool does "simple" maven build(s), the builds are just Maven commands, but because the repositories relates and depends on each other and any change in API or class method could affect several of those repositories there is a need to use build-chain tool to handle cross repository builds and be sure that we always use latest version of the code for each repository.

build-chain tool is a build tool which can be used locally on command line or in Github Actions workflow(s), in case you need to change multiple repositories and send multiple dependent pull requests related with a change you can easily reproduce the same build by executing it on Github hosted environment or locally in your development environment. See local execution details to get more information about it.

A general local execution could be the following one, where the tool clones all dependent projects starting from the -sp one and it locally applies the pull request (if it exists) in order to reproduce a complete build scenario for the provided Pull Request.

Note: the tool considers multiple Pull Requests related to each other if their branches (generally in the forked repositories) have the same name.

$ build-chain-action -df 'https://raw.githubusercontent.com/${GROUP:kiegroup}/droolsjbpm-build-bootstrap/${BRANCH:main}/.ci/pull-request-config.yaml' build pr -url <pull-request-url> -sp kiegroup/kie-wb-distributions [--skipExecution]

Consider changing kiegroup/kie-wb-distributions with the correct starting project.

How to retest this PR or trigger a specific build:

a pull request please add comment: Jenkins retest (using this e.g. Jenkins retest this optional but no longer required)
for a full downstream build
- for jenkins job: please add comment: Jenkins run fdb
- for github actions job: add the label run_fdb
a compile downstream build please add comment: Jenkins run cdb
a full production downstream build please add comment: Jenkins execute product fdb
an upstream build please add comment: Jenkins run upstream
for windows-specific os job add the label windows_check

How to backport a pull request to a different branch?

In order to automatically create a backporting pull request please add one or more labels having the following format backport-<branch-name>, where <branch-name> is the name of the branch where the pull request must be backported to (e.g., backport-7.67.x to backport the original PR to the 7.67.x branch).

NOTE: backporting is an action aiming to move a change (usually a commit) from a branch (usually the main one) to another one, which is generally referring to a still maintained release branch. Keeping it simple: it is about to move a specific change or a set of them from one branch to another.

Once the original pull request is successfully merged, the automated action will create one backporting pull request per each label (with the previous format) that has been added.

If something goes wrong, the author will be notified and at this point a manual backporting is needed.

NOTE: this automated backporting is triggered whenever a pull request on main branch is labeled or closed, but both conditions must be satisfied to get the new PR created.

Ginxo · 2023-06-20T05:53:46Z

Jenkins run fdb

Ginxo · 2023-08-09T08:24:57Z

Jenkins run fdb

mareknovotny · 2023-08-09T08:48:55Z

@Ginxo i can see the problem with artifact we are trying to upgrade?

 Caused by: org.eclipse.aether.transfer.ArtifactNotFoundException: Could not find artifact org.bouncycastle:bcprov-jdk15on:jar:1.74 in mirror-central (https://bxms-qe.rhev-ci-vms.eng.rdu2.redhat.com:8443/nexus/content/groups/kie-all/)

rgdoliveira · 2023-08-09T09:09:47Z

it seems bouncycastle stopped to release the artifacts with artifact id *-jdk15on from version 1.70 and they are now using *-jdk15to18?

E.g bcprov-jdk15on was released until version 1.70 and bcprov-jdk15to18 is released for version 1.74.

Ginxo · 2023-08-09T09:34:20Z

Jenkins run fdb

Ginxo · 2023-08-09T11:30:14Z

Jenkins run fdb

Ginxo · 2023-08-10T06:07:35Z

Jenkins run fdb

mareknovotny · 2023-08-10T13:18:26Z

jenkins retest this please

mareknovotny · 2023-08-10T13:18:33Z

jenkins do fdb

Ginxo · 2023-08-11T05:18:56Z

Jenkins run fdb

Ginxo · 2023-08-11T05:31:08Z

Jenkins run fdb

Ginxo · 2023-08-11T05:32:04Z

Jenkins run fdb

Ginxo · 2023-08-11T18:46:09Z

some of the tests from jbpm-workitems are failing, need further investigation:

org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testGetBalance 1.9 sec 1
org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testSendEther 11 ms 1
org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testQueryExistingContract 11 ms 1
org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testTransactExistingContract 9 ms 1
org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testDeployContract 10 ms 1
org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testObserveContractUpdates 15 ms 1
org.jbpm.workitem.springboot.samples.KafkaProxyAsyncSampleTest.testAsyncKafkaWIHNoConnection[0: SINGLETON]

Ginxo · 2023-08-14T05:43:29Z

some of the tests from jbpm-workitems are failing, need further investigation:

* org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testGetBalance	1.9 sec	1

* org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testSendEther	11 ms	1

* org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testQueryExistingContract	11 ms	1

* org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testTransactExistingContract	9 ms	1

* org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testDeployContract	10 ms	1

* org.jbpm.process.workitem.ethereum.test.EthereumWorkitemHandlerTest.testObserveContractUpdates	15 ms	1

* org.jbpm.workitem.springboot.samples.KafkaProxyAsyncSampleTest.testAsyncKafkaWIHNoConnection[0: SINGLETON]

already solved by kiegroup/jbpm-work-items#288
Jenkins run fdb

* bouncycastle upgraded to 1.74 * org.bouncycastle.bcp.*-jdk15on to org.bouncycastle.bcp.*-jdk15to18

…2362) * bouncycastle upgraded to 1.74 * org.bouncycastle.bcp.*-jdk15on to org.bouncycastle.bcp.*-jdk15to18 Co-authored-by: Enrique Mingorance Cano <ginxaco@gmail.com>

…2361) * bouncycastle upgraded to 1.74 * org.bouncycastle.bcp.*-jdk15on to org.bouncycastle.bcp.*-jdk15to18 Co-authored-by: Enrique Mingorance Cano <ginxaco@gmail.com>

bouncycastle upgraded to 1.74

f403c95

Ginxo requested review from mareknovotny and rgdoliveira June 20, 2023 05:53

Ginxo marked this pull request as draft June 20, 2023 06:39

Ginxo closed this Jun 20, 2023

mareknovotny changed the title ~~[RHPAM-4734] [TRIAGE-CVE-2023-33201] bouncycastle upgraded to 1.74~~ [RHPAM-4734] [CVE-2023-33201] bouncycastle upgraded to 1.74 Aug 9, 2023

mareknovotny reopened this Aug 9, 2023

Ginxo marked this pull request as ready for review August 9, 2023 08:24

Merge remote-tracking branch 'upstream/main' into RHPAM-4734

6b31ff7

Ginxo mentioned this pull request Aug 9, 2023

[RHPAM-4734] [CVE-2023-33201] bouncycastle upgraded to 1.74 kiegroup/jbpm#2315

Merged

org.bouncycastle.bcp.*-jdk15on to org.bouncycastle.bcp.*-jdk15to18

47d9358

Ginxo mentioned this pull request Aug 9, 2023

org.bouncycastle.bcp.*-jdk15on to org.bouncycastle.bcp.*-jdk15to18 kiegroup/jbpm-work-items#288

Merged

mareknovotny added backport-7.67.x Generate backport PR for 7.67.x branch backport-7.67.x-blue Generate backport PR for 7.67.x-blue branch labels Aug 14, 2023

mareknovotny approved these changes Aug 14, 2023

View reviewed changes

rgdoliveira approved these changes Aug 14, 2023

View reviewed changes

mareknovotny merged commit 7120ad0 into kiegroup:main Aug 14, 2023
13 of 16 checks passed

github-actions bot pushed a commit that referenced this pull request Aug 14, 2023

[RHPAM-4734] [CVE-2023-33201] bouncycastle upgraded to 1.74 (#2324)

02b8503

* bouncycastle upgraded to 1.74 * org.bouncycastle.bcp.*-jdk15on to org.bouncycastle.bcp.*-jdk15to18

github-actions bot mentioned this pull request Aug 14, 2023

[7.67.x-blue] [RHPAM-4734] [CVE-2023-33201] bouncycastle upgraded to 1.74 kiegroup/jbpm#2317

Merged

github-actions bot pushed a commit that referenced this pull request Aug 14, 2023

[RHPAM-4734] [CVE-2023-33201] bouncycastle upgraded to 1.74 (#2324)

7834026

* bouncycastle upgraded to 1.74 * org.bouncycastle.bcp.*-jdk15on to org.bouncycastle.bcp.*-jdk15to18

This was referenced Aug 14, 2023

[7.67.x-blue] org.bouncycastle.bcp.*-jdk15on to org.bouncycastle.bcp.*-jdk15to18 kiegroup/jbpm-work-items#289

Merged

[7.67.x] org.bouncycastle.bcp.*-jdk15on to org.bouncycastle.bcp.*-jdk15to18 kiegroup/jbpm-work-items#290

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[RHPAM-4734] [CVE-2023-33201] bouncycastle upgraded to 1.74 #2324

[RHPAM-4734] [CVE-2023-33201] bouncycastle upgraded to 1.74 #2324

Ginxo commented Jun 20, 2023 •

edited

Loading

Ginxo commented Jun 20, 2023

Ginxo commented Aug 9, 2023

mareknovotny commented Aug 9, 2023

rgdoliveira commented Aug 9, 2023 •

edited

Loading

Ginxo commented Aug 9, 2023

Ginxo commented Aug 9, 2023

Ginxo commented Aug 10, 2023

mareknovotny commented Aug 10, 2023

mareknovotny commented Aug 10, 2023

Ginxo commented Aug 11, 2023

Ginxo commented Aug 11, 2023

Ginxo commented Aug 11, 2023

Ginxo commented Aug 11, 2023

Ginxo commented Aug 14, 2023

[RHPAM-4734] [CVE-2023-33201] bouncycastle upgraded to 1.74 #2324

[RHPAM-4734] [CVE-2023-33201] bouncycastle upgraded to 1.74 #2324

Conversation

Ginxo commented Jun 20, 2023 • edited Loading

Ginxo commented Jun 20, 2023

Ginxo commented Aug 9, 2023

mareknovotny commented Aug 9, 2023

rgdoliveira commented Aug 9, 2023 • edited Loading

Ginxo commented Aug 9, 2023

Ginxo commented Aug 9, 2023

Ginxo commented Aug 10, 2023

mareknovotny commented Aug 10, 2023

mareknovotny commented Aug 10, 2023

Ginxo commented Aug 11, 2023

Ginxo commented Aug 11, 2023

Ginxo commented Aug 11, 2023

Ginxo commented Aug 11, 2023

Ginxo commented Aug 14, 2023

Ginxo commented Jun 20, 2023 •

edited

Loading

rgdoliveira commented Aug 9, 2023 •

edited

Loading