Repository navigation
Use commons 3.2.2 to pick up BouncyCastle 1.86 - #1190
Merged
vharseko merged 2 commits intoOct 21, 2026
Merged
Conversation
vharseko
added
dependencies
maximthomas
approved these changes
Oct 13, 2026
vharseko
force-pushed
the
bump-commons-3.2.2-snapshot
branch
from
October 14, 2026 07:28
e7b8cb8 to
9b93501
Compare
vharseko
added a commit
that referenced
this pull request
Oct 14, 2026
…ord it leaves (#1193) ## Problem Since #1184, `build-docker` and `build-docker-alpine` fail every time, on master too (run 38390334148) and on every PR (e.g. #1190, run 38382364790): ``` === [2608 s] pre-roles srs volume ##[error]the root password is left in /dev/shm/opendj-join.4444.YKR3cc of dj-1 ``` The phase "pre-roles srs volume" (`.github/scripts/docker-test-replication.sh`) recreates dj-1 on its kept volume, which has neither `.initialize-pending` nor `.rejoin-pending`. So `run.sh` writes the health marker at once and starts `join.sh` in the background. The test waits for "already a member of the replication topology" and for `healthy`, which both hold at once, and runs the password check straight away. At that point `join.sh` is still in `joined()` (`cleanup_departed`, `publish_state`, `repair_replication_servers`) and keeps its password file in `/dev/shm`. Its EXIT trap removes the file only when it ends. The dj-1 log in CI does not even show "the health check may probe it" yet. The image itself is fine: the file goes away when the join ends. The test checks too early. It slipped through because only the role phases, not the whole script, ran locally in round 4 of #1184. ## Fix - `bootstrap_ended <container>`: true once no `bootstrap/join.sh` or `bootstrap/replicate.sh` process is left in the container. It looks for them in `/proc/*/cmdline`; the bracket in `[j]oin` keeps the pattern from matching the `sh -c` that greps for it. - The password check waits up to 300 s for it on each container. A join that never ends still fails the test, by timeout. ## Testing - `bash -n` passes. - The helper was run against a stand-in `bootstrap/join.sh` / `bootstrap/replicate.sh` (`sleep 8`) in `ubuntu:24.04`, `alpine:3.20` and the OpenDJ image: "running" while the script runs, "ended" after it. The image's PID 1 is `/opt/opendj/run.sh`, which does not match. - The whole Docker replication test was not run locally. The `build-docker` jobs of this PR are the check.
vharseko
added
bug
logging
vharseko
changed the title
commons 3.2.2-SNAPSHOT manages bc-jdk18on-bom 1.86 (commons PR OpenIdentityPlatform#326), which fixes CVE-2026-8763 and CVE-2026-13506 in bcprov-jdk18on 1.84. OpenDJ itself uses only the FIPS artifacts, already at bc-fips 2.1.3; the bump reaches OpenICF, which imports opendj-parent as its BOM.
vharseko
force-pushed
the
bump-commons-3.2.2-snapshot
branch
from
October 20, 2026 10:22
c2d251c to
b855679
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
commons.versionfrom 3.2.1 to 3.2.2.commons 3.2.2 manages
bc-jdk18on-bom1.86 (OpenIdentityPlatform/commons#326), which fixes CVE-2026-8763 (critical) and CVE-2026-13506 inbcprov-jdk18on1.84.OpenDJ itself uses only the FIPS artifacts, and
bc.fips.versionis already 2.1.3 on master. The bump matters for OpenICF: it importsopendj-parentas its BOM, and that is where itsbcprov-jdk18onversion comes from. Trivy flagsbcprov-jdk18on-1.84.jarin OpenICF'slib/framework.Between 3.2.1 and 3.2.2 the commons parent moves two managed versions: the BouncyCastle BOM (1.84 → 1.86) and
org.json:json(20231013 → 20260814); no OpenDJ module depends on either. Theban-jvnet-parentenforcer rule that 3.2.2 adds reaches only the projects that inherit the commons parent; OpenDJ imports it as a BOM, so thejaxb-apiandjaxb-coredependencies ofopendj-coreare not affected.Merge order: the OpenICF PR that moves
opendj.versionto 5.2.0-SNAPSHOT follows this one.Also fixes #1196. The retention scan of the JSON access logger that #1196 reports (
TimestampFilenameFilter,JsonFileWriter) is commons code, tracked as OpenIdentityPlatform/commons#329 and fixed by OpenIdentityPlatform/commons#330, which 3.2.2 includes; this version update is what brings the fix into OpenDJ.