From e1f9011306a38a70c085d3f8f9773257d8c6fdf2 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Thu, 8 Oct 2026 09:25:33 +0200
Subject: [PATCH 1/3] client: exclude jdk15on BouncyCastle artifacts from the
 shaded jar

The client shade config only excluded the jdk18on BouncyCastle artifacts,
which are shipped as separate jars in the management server lib folder.
If a stale or transitive dependency pulls in bcprov/bcpkix/bctls-jdk15on,
the old classes are bundled into the fat jar and can shadow
bcprov-jdk18on depending on the classpath order of lib/*, failing with
NoSuchFieldError (e.g. xmss_SHAKE128_512ph) when the root CA module starts.
---
 client/pom.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/client/pom.xml b/client/pom.xml
index cc031a4912b1..6b415fa13e36 100644
--- a/client/pom.xml
+++ b/client/pom.xml
@@ -1000,6 +1000,10 @@
                                     <exclude>org.bouncycastle:bcprov-jdk18on</exclude>
                                     <exclude>org.bouncycastle:bcpkix-jdk18on</exclude>
                                     <exclude>org.bouncycastle:bctls-jdk18on</exclude>
+                                    <exclude>org.bouncycastle:bcprov-jdk15on</exclude>
+                                    <exclude>org.bouncycastle:bcpkix-jdk15on</exclude>
+                                    <exclude>org.bouncycastle:bctls-jdk15on</exclude>
+                                    <exclude>org.bouncycastle:bcutil-jdk15on</exclude>
                                     <exclude>com.mysql:mysql-connector-j</exclude>
                                     <exclude>org.apache.cloudstack:cloud-plugin-storage-volume-storpool</exclude>
                                     <exclude>org.apache.cloudstack:cloud-plugin-storage-volume-linstor</exclude>

From 925429df884ef2bde56a4187f0915c47c61f7be3 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Thu, 8 Oct 2026 12:24:23 +0200
Subject: [PATCH 2/3] Revert "client: exclude jdk15on BouncyCastle artifacts
 from the shaded jar"

This reverts commit e1f9011306a38a70c085d3f8f9773257d8c6fdf2.
---
 client/pom.xml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/client/pom.xml b/client/pom.xml
index 6b415fa13e36..cc031a4912b1 100644
--- a/client/pom.xml
+++ b/client/pom.xml
@@ -1000,10 +1000,6 @@
                                     <exclude>org.bouncycastle:bcprov-jdk18on</exclude>
                                     <exclude>org.bouncycastle:bcpkix-jdk18on</exclude>
                                     <exclude>org.bouncycastle:bctls-jdk18on</exclude>
-                                    <exclude>org.bouncycastle:bcprov-jdk15on</exclude>
-                                    <exclude>org.bouncycastle:bcpkix-jdk15on</exclude>
-                                    <exclude>org.bouncycastle:bctls-jdk15on</exclude>
-                                    <exclude>org.bouncycastle:bcutil-jdk15on</exclude>
                                     <exclude>com.mysql:mysql-connector-j</exclude>
                                     <exclude>org.apache.cloudstack:cloud-plugin-storage-volume-storpool</exclude>
                                     <exclude>org.apache.cloudstack:cloud-plugin-storage-volume-linstor</exclude>

From 0b340c5960f00625d14d1e4de116fe08e702a0e1 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Thu, 8 Oct 2026 12:20:24 +0200
Subject: [PATCH 3/3] netris: exclude jdk15on BouncyCastle artifacts from
 netris-java-sdk

The netris-java-sdk 1.0.0 artifact was republished without a version bump
and now declares bcprov-jdk15on and bctls-jdk15on 1.70. These were shaded
into the management server jar next to the bcprov/bcpkix/bctls-jdk18on 1.83
jars in lib/, and the old classes could shadow the new ones depending on
the classpath order, failing with NoSuchFieldError (xmss_SHAKE128_512ph)
when the root CA module starts.

The SDK still gets BouncyCastle (BouncyCastleProvider and
BouncyCastleJsseProvider) from the managed jdk18on 1.83 artifacts.
---
 plugins/network-elements/netris/pom.xml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/plugins/network-elements/netris/pom.xml b/plugins/network-elements/netris/pom.xml
index f98bb8a30638..2423083b2436 100644
--- a/plugins/network-elements/netris/pom.xml
+++ b/plugins/network-elements/netris/pom.xml
@@ -34,6 +34,25 @@
             <groupId>io.netris</groupId>
             <artifactId>netris-java-sdk</artifactId>
             <version>1.0.0</version>
+            <exclusions>
+                <!-- BouncyCastle is provided by the bcprov/bctls-jdk18on jars managed by the parent pom -->
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcprov-jdk15on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcpkix-jdk15on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bctls-jdk15on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcutil-jdk15on</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.github.seancfoley</groupId>