search

vt-middleware / cryptacular

The friendly complement to the BouncyCastle crypto API for Java.
Other
39 stars 7 forks source link

Backport #52 to v1.1 #56

Closed aldaris closed 4 years ago

aldaris commented 4 years ago

Hi,

A couple of our dependencies are using cryptacular v1.1.x and are not really keen to upgrade to 1.2 (I suppose Java version compatibility concerns is one reason), so I was thinking whether there is a middle ground solution for this, where the older version of cryptacular also gets the security fix (so that cryptacular stops showing up on vulnerable third party library scans). The original commits I left untouched, all my silly compilation fixes were done in a separate commit. Let me know what you think. I appreciate that my current solution is not ideal because it introduces a new type immediately with a @deprecated annotation, so I'm keen to hear your thoughts on alternative ways of backporting this change without completely breaking backwards/forwards compatibility. CipherTextHeaderV2#setKeyLookup is a definite API breaking change, and it's difficult to get around...

Thanks for your review.

dfish3r commented 4 years ago

@serac take a look at this backport of #52. If it works I can cut a v1.1 release.