Enable PQ TLS for outbound com by default - #4617
Conversation
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe PR updates the Bouncy Castle version and configures Bouncy Castle JSSE client early-key-share groups during Carbon core startup. ChangesBouncy Castle JSSE update
Estimated code review effort: 1 (Trivial) | ~5 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/internal/CarbonCoreActivator.java`:
- Line 85: Update the startup logic in CarbonCoreActivator to set the
org.bouncycastle.jsse.client.earlyKeyShares default only when System.getProperty
for that key returns null, preserving any operator-supplied value.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: CHILL
Plan: Pro Plus
Run ID: 0fc223ce-199d-4379-84a9-3715701dbb8e
📒 Files selected for processing (2)
core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/internal/CarbonCoreActivator.javaparent/pom.xml
| (Class.forName("org.bouncycastle.jsse.provider.BouncyCastleJsseProvider")). | ||
| getDeclaredConstructor().newInstance(); | ||
| Security.insertProviderAt(jsseProvider, 1); | ||
| System.setProperty("org.bouncycastle.jsse.client.earlyKeyShares", "X25519,X25519MLKEM768"); |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
file='core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/internal/CarbonCoreActivator.java'
printf '%s\n' '--- target context ---'
sed -n '60,105p' "$file"
printf '%s\n' '--- references to the property ---'
rg -n -C 3 'org\.bouncycastle\.jsse\.client\.earlyKeyShares|earlyKeyShares' .
printf '%s\n' '--- activator lifecycle and property setup ---'
rg -n -C 4 'class CarbonCoreActivator|start\(|stop\(|System\.setProperty|System\.getProperty' "$file"Repository: wso2/carbon-kernel
Length of output: 6767
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- Bouncy Castle dependency declarations ---'
rg -n -i -C 3 'bouncycastle|bcprov|bctls|bcutil|jsse' --glob 'pom.xml' --glob '*.xml' --glob '*.properties' --glob '*.gradle' --glob '*.gradle.kts' .
printf '%s\n' '--- provider configuration constants and documentation ---'
rg -n -i -C 4 'JSSE_PROVIDER_BC|JSSE_PROVIDER|early key|earlyKeyShares|named group|BouncyCastle JSSE' \
--glob '!target/**' --glob '!build/**' .
printf '%s\n' '--- relevant project documentation files ---'
git ls-files | rg -i '(^|/)(readme|security|configuration|deployment|carbon\.xml|defaults).*|bouncycastle|jsse'Repository: wso2/carbon-kernel
Length of output: 27773
🌐 Web query:
Bouncy Castle JSSE org.bouncycastle.jsse.client.earlyKeyShares system property default
💡 Result:
The system property org.bouncycastle.jsse.client.earlyKeyShares does not have a defined default value; if the property is not explicitly set, the Bouncy Castle JSSE (BCJSSE) client behaves as if no early key shares are configured [1][2]. When this property is used, it accepts a comma-separated list of group names, following the same syntax as the standard jdk.tls.namedGroups property [1][2]. Any groups specified in this property must be independently enabled as supported groups—either by default or through other configurations such as jdk.tls.namedGroups or SSLParameters.namedGroups—otherwise, they will be ignored [1][2]. The property is read whenever a BCJSSE SSLContext is created and affects all client connections established using that context [1]. Alternatively, developers can control early key shares programmatically using the BCSSLParameters.earlyKeyShares property [1][3].
Citations:
- 1: Support for multiple key share entries in ClientHello bcgit/bc-java#2095
- 2: https://downloads.bouncycastle.org/fips-java/docs/BC-FJA-(D)TLSUserGuide-2.0.23.pdf
- 3: https://www.bouncycastle.org/download/bouncy-castle-java-lts/
Preserve an operator-supplied earlyKeyShares value.
org.bouncycastle.jsse.client.earlyKeyShares controls BCJSSE SSLContext creation. Set this default only when System.getProperty(...) == null; otherwise, the startup code overrides the operator’s TLS configuration.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In
`@core/org.wso2.carbon.core/src/main/java/org/wso2/carbon/core/internal/CarbonCoreActivator.java`
at line 85, Update the startup logic in CarbonCoreActivator to set the
org.bouncycastle.jsse.client.earlyKeyShares default only when System.getProperty
for that key returns null, preserving any operator-supplied value.
Source: MCP tools
1 participant
Purpose
Goals
Approach
User stories
Release note
Documentation
Training
Certification
Marketing
Automation tests
Security checks
Samples
Related PRs
Migrations (if applicable)
Test environment
Learning