[GR-78840] Make BouncyCastle opt-in

CHANGELOG.md

@@ -3,13 +3,16 @@
 This changelog summarizes major changes between GraalVM versions of the Python
 language runtime. The main focus is on user-observable behavior of the engine.
 
-## Version 25.3.4
+## Version 25.4
+* Remove BouncyCastle entirely. BouncyCastle was only needed for legacy RSA, DSA, and EC private keys versions 0 and 1. To support these from Python embeddings, BouncyCastle must now be explicitly enabled by adding the `org.graalvm.python:python-bouncycastle-support` Maven _and_ adding `bcprov-jdk18on`, `bcpkix-jdk18on`, and `bcutil-jdk18on` dependencies.
+
+## Version 25.3
 * Update Python standard library to 3.13.14 and implement new Python 3.13 features.
 
-## Version 25.2.4
+## Version 25.2
 * Windows standalone builds now use a native OS backend by default, improving compatibility for files, sockets, subprocesses, `mmap`, and Windows-specific modules compared to the Java-based backend.
 
-## Version 25.1.3
+## Version 25.1
 * The standalone artifacts now include the Python version name before the Graal version. The new artifacts now start with `graalpy<PYTHON_VERSION>-<GRAAL_VERSION>-<OPERATING_SYSTEM>-<ARCHITECTURE>`.
 * Standalone JVM artifacts are no longer released as separate distributions. For standalone deployments, use the GraalPy native artifacts. If you require Java interoperability, use our jbang launcher (`jbang graalpy@oracle/graalpython -c "print('hello from GraalPy')"`) or a custom embedding.
 * Add `-X jit=0|1|2` presets to tune startup-heavy or throughput-oriented workloads, and make the GraalPy launcher default to the `jit=1` preset.
@@ -31,7 +34,7 @@ language runtime. The main focus is on user-observable behavior of the engine.
 * Add an experimental `python.InitializationEntropySource` option to control the entropy source used for initialization-only randomness such as hash secret generation and `random.Random(None)` seeding. This means embeddings and tests can select deterministic or externally provided initialization entropy without affecting cryptographically relevant APIs like `os.urandom()` or `random.SystemRandom()`.
 * Dispatch `sys.audit` events to hooks registered with `sys.addaudithook`, including audit events raised through the `PySys_Audit` C API.
 * Foreign temporal objects (dates, times, and timezones) are now given a Python class corresponding to their interop traits, i.e., `date`, `time`, `datetime`, or `tzinfo`. This allows any foreign objects with these traits to be used in place of the native Python types and Python methods available on these types work on the foreign types.
-* Make BouncyCastle an optional dependency for embedding use cases. BouncyCastle is only needed for legacy RSA, DSA, and EC privat keys versions 0 and 1. To support these from Python embeddings, BouncyCastle must now be explicitly enabled by adding the `org.graalvm.python:python-bouncycastle-support` Maven artifact.
+* Make BouncyCastle an optional dependency for embedding use cases. BouncyCastle is only needed for legacy RSA, DSA, and EC private keys versions 0 and 1. To support these from Python embeddings, BouncyCastle must now be explicitly enabled by adding the `org.graalvm.python:python-bouncycastle-support` Maven artifact.
 * The GraalPy Native standalone on Linux now uses a lower-footprint Native Image garbage collection configuration. This reduces resident set size (RSS) for many workloads, but may increase startup time and warmup time, and can slow down some workloads.
 
 ## Version 25.0.1

ci.jsonnet

@@ -167,6 +167,13 @@
             "darwin:aarch64:jdk-latest"  : tier3                     + provide(GPY_JVM_STANDALONE),
             "windows:amd64:jdk-latest"   : tier3                     + provide(GPY_JVM_STANDALONE),
         }),
+        "python-unittest-bouncycastle": gpgate + task_spec({
+            environment +: {
+                GRAALPY_WITH_BOUNCYCASTLE: "true",
+            },
+        }) + platform_spec(no_jobs) + platform_spec({
+            "linux:amd64:jdk-latest"     : tier2,
+        }),
         "python-unittest-native-debug-build": gpgate + platform_spec(no_jobs) + native_debug_build_gate("python-unittest") + platform_spec({
             "linux:amd64:jdk-latest"     : tier3,
         }),

graalpython/com.oracle.graal.python.annotations/pom.xml

@@ -69,7 +69,7 @@ SOFTWARE.
             </goals>
             <configuration>
               <sources>
-                <source>../../mxbuild/jdk25/com.oracle.graal.python.annotations/src_gen</source>
+                <source>../../mxbuild/graalpython/com.oracle.graal.python.annotations/src_gen</source>
               </sources>
             </configuration>
           </execution>

graalpython/com.oracle.graal.python.bouncycastle/pom.xml

@@ -92,7 +92,7 @@ SOFTWARE.
             </goals>
             <configuration>
               <sources>
-                <source>../../mxbuild/jdk25/com.oracle.graal.python.bouncycastle/src_gen</source>
+                <source>../../mxbuild/graalpython/com.oracle.graal.python.bouncycastle/src_gen</source>
               </sources>
             </configuration>
           </execution>

graalpython/com.oracle.graal.python.pegparser/pom.xml

@@ -76,7 +76,7 @@ SOFTWARE.
             </goals>
             <configuration>
               <sources>
-                <source>../../mxbuild/jdk25/com.oracle.graal.python.pegparser/src_gen</source>
+                <source>../../mxbuild/graalpython/com.oracle.graal.python.pegparser/src_gen</source>
               </sources>
             </configuration>
           </execution>

graalpython/com.oracle.graal.python.processor/pom.xml

@@ -76,7 +76,7 @@ SOFTWARE.
             </goals>
             <configuration>
               <sources>
-                <source>../../mxbuild/jdk25/com.oracle.graal.python.processor/src_gen</source>
+                <source>../../mxbuild/graalpython/com.oracle.graal.python.processor/src_gen</source>
               </sources>
             </configuration>
           </execution>

graalpython/com.oracle.graal.python.resources/pom.xml

@@ -90,7 +90,7 @@ SOFTWARE.
             </goals>
             <configuration>
               <sources>
-                <source>../../mxbuild/jdk25/com.oracle.graal.python.resources/src_gen</source>
+                <source>../../mxbuild/graalpython/com.oracle.graal.python.resources/src_gen</source>
               </sources>
             </configuration>
           </execution>

graalpython/com.oracle.graal.python.shell/pom.xml

@@ -88,7 +88,7 @@ SOFTWARE.
             </goals>
             <configuration>
               <sources>
-                <source>../../mxbuild/jdk25/com.oracle.graal.python.shell/src_gen</source>
+                <source>../../mxbuild/graalpython/com.oracle.graal.python.shell/src_gen</source>
               </sources>
             </configuration>
           </execution>

graalpython/com.oracle.graal.python.test/src/tests/ssldata/leaf-missing-aki.pkcs8.pem

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgXlF778U/euD7tzWh
+0oRA9eFv1XrmReeVkhYcMb2AqsuhRANCAATVYBAx0LuKaztP2Wkr27NoK4qodv+g
+0xsaOHV/XSk4e/dn6gC+yoVK/eEbOt67r1gvLTVp8DqxQJ/UAD/3l0qS
+-----END PRIVATE KEY-----

graalpython/com.oracle.graal.python.test/src/tests/test_ssl.py

@@ -126,7 +126,10 @@ def test_verify_x509_partial_chain(self):
     @unittest.skipUnless(IS_OPENSSL_3_0_0, "test requires RFC 5280 check added in OpenSSL 3.0+")
     def test_verify_x509_strict(self):
         server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-        server_context.load_cert_chain(cpython_cert_data("leaf-missing-aki.keycert.pem"))
+        server_context.load_cert_chain(
+            cpython_cert_data("leaf-missing-aki.keycert.pem"),
+            keyfile=data_file("leaf-missing-aki.pkcs8.pem"),
+        )
 
         client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
         client_context.check_hostname = False
@@ -404,7 +407,11 @@ def test_verify_mode(self):
 
     def check_keypair(self, signed_cert, signing_ca, password=None):
         server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-        server_context.load_cert_chain(data_file(signed_cert), password=password)
+        try:
+            server_context.load_cert_chain(data_file(signed_cert), password=password)
+        except ssl.SSLError as e:
+            self.assertIn("require BouncyCastle support", str(e))
+            return
         client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
         client_context.load_verify_locations(data_file(signing_ca))
         check_handshake(server_context, client_context)
@@ -421,17 +428,26 @@ def test_private_key_pkcs1(self):
     def test_private_key_pkcs1_password(self):
         self.check_keypair("signed_cert_pkcs1_password.pem", "signing_ca.pem", password="password")
 
-    def test_private_key_ec_legacy(self):
+    def load_legacy_cert_chain(self, certfile, keyfile):
         server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-        server_context.load_cert_chain(data_file("keycertecc.pem"), keyfile=data_file("pk_ecc_legacy.pem"))
+        try:
+            server_context.load_cert_chain(data_file(certfile), keyfile=data_file(keyfile))
+        except ssl.SSLError as e:
+            self.assertIn("require BouncyCastle support", str(e))
+            return None
+        return server_context
+
+    def test_private_key_ec_legacy(self):
+        server_context = self.load_legacy_cert_chain("keycertecc.pem", "pk_ecc_legacy.pem")
+        if server_context is None:
+            return
         client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
         client_context.check_hostname = False
         client_context.verify_mode = ssl.CERT_NONE
         check_handshake(server_context, client_context)
 
     def test_private_key_dsa_legacy(self):
-        server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
-        server_context.load_cert_chain(data_file("cert_dsa.pem"), keyfile=data_file("pk_dsa_legacy.pem"))
+        self.load_legacy_cert_chain("cert_dsa.pem", "pk_dsa_legacy.pem")
 
     def test_alpn(self):
         signed_cert = data_file("signed_cert.pem")

graalpython/com.oracle.graal.python.test/src/tests/unittest_tags/test_hashlib.txt

@@ -1,12 +1,5 @@
-test.test_hashlib.HashLibTestCase.test_algorithms_available @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_algorithms_guaranteed @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_blocksize_and_name @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_blocksize_name_blake2 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_blocksize_name_sha3 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_case_blake2b_0 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_case_blake2b_1 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_case_blake2s_0 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_case_blake2s_1 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_case_md5_0 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_case_md5_1 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_case_md5_2 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
@@ -38,17 +31,10 @@ test.test_hashlib.HashLibTestCase.test_case_sha512_0 @ darwin-arm64,linux-aarch6
 test.test_hashlib.HashLibTestCase.test_case_sha512_1 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_case_sha512_2 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_case_sha512_3 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_clinic_signature @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github
-test.test_hashlib.HashLibTestCase.test_digest_length_overflow @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_extra_sha3 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_get_builtin_constructor @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_get_fips_mode @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_gil @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_hash_array @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_hash_disallow_instantiation @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_hexdigest @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_large_update @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_name_attribute @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_new_upper_to_lower @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_no_unicode @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_no_unicode_blake2 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
@@ -58,8 +44,6 @@ test.test_hashlib.HashLibTestCase.test_sha256_update_over_4gb @ darwin-arm64,lin
 test.test_hashlib.HashLibTestCase.test_sha3_256_update_over_4gb @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_threaded_hashing @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.HashLibTestCase.test_unknown_hash @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_usedforsecurity_false @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
-test.test_hashlib.HashLibTestCase.test_usedforsecurity_true @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.KDFTests.test_file_digest @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.KDFTests.test_normalized_name @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github
 test.test_hashlib.KDFTests.test_pbkdf2_hmac_c @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github,win32-AMD64,win32-AMD64-github

graalpython/com.oracle.graal.python.test/src/tests/unittest_tags/test_ssl.txt

@@ -114,7 +114,6 @@ test.test_ssl.ThreadedTests.test_ssl_cert_verify_error @ darwin-arm64,linux-aarc
 test.test_ssl.ThreadedTests.test_starttls @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github
 test.test_ssl.ThreadedTests.test_thread_recv_while_main_thread_sends @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github
 test.test_ssl.ThreadedTests.test_tls1_3 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github
-test.test_ssl.ThreadedTests.test_verify_strict @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github
 test.test_ssl.ThreadedTests.test_version_basic @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github
 test.test_ssl.ThreadedTests.test_wrong_cert_tls12 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github
 test.test_ssl.ThreadedTests.test_wrong_cert_tls13 @ darwin-arm64,linux-aarch64,linux-aarch64-github,linux-x86_64,linux-x86_64-github

graalpython/com.oracle.graal.python/pom.xml

@@ -116,7 +116,7 @@ SOFTWARE.
             </goals>
             <configuration>
               <sources>
-                <source>../../mxbuild/jdk25/com.oracle.graal.python/src_gen</source>
+                <source>../../mxbuild/graalpython/com.oracle.graal.python/src_gen</source>
               </sources>
             </configuration>
           </execution>