From 0f522cec666dfe96984cfae125b6a426508de261 Mon Sep 17 00:00:00 2001
From: PJ Fanning <fanningpj@apache.org>
Date: Fri, 14 Feb 2020 23:18:44 +0000
Subject: [PATCH] bouncycastle 1.64

git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1874039 13f79535-47bb-0310-9956-ffa450edef68
---
 .classpath                                    |  6 ++---
 build.gradle                                  |  3 ++-
 build.xml                                     | 25 ++++++++++---------
 sonar/ooxml/pom.xml                           |  4 +--
 .../poi/poifs/crypt/dsig/SignatureInfo.java   |  4 +--
 5 files changed, 22 insertions(+), 20 deletions(-)

diff --git a/.classpath b/.classpath
index b668ce8c03..98fe5cd3cb 100644
--- a/.classpath
+++ b/.classpath
@@ -27,9 +27,9 @@
 	<classpathentry kind="lib" path="lib/jmh-core-1.19.jar"/>
 	<classpathentry kind="lib" path="lib/jmh-generator-annprocess-1.19.jar"/>
 	<classpathentry kind="con" path="org.eclipse.jdt.launching.JRE_CONTAINER/org.eclipse.jdt.internal.debug.ui.launcher.StandardVMType/JavaSE-1.8"/>
-	<classpathentry exported="true" kind="lib" path="compile-lib/slf4j-api-1.7.26.jar"/>
-	<classpathentry kind="lib" path="compile-lib/bcpkix-jdk15on-1.62.jar"/>
-	<classpathentry kind="lib" path="compile-lib/bcprov-ext-jdk15on-1.62.jar"/>
+	<classpathentry exported="true" kind="lib" path="compile-lib/slf4j-api-1.7.30.jar"/>
+	<classpathentry kind="lib" path="compile-lib/bcpkix-jdk15on-1.64.jar"/>
+	<classpathentry kind="lib" path="compile-lib/bcprov-ext-jdk15on-1.64.jar"/>
 	<classpathentry kind="lib" path="ooxml-testlib/reflections.jar"/>
 	<classpathentry kind="lib" path="ooxml-testlib/guava.jar"/>
 	<classpathentry kind="lib" path="ooxml-testlib/javassist.jar"/>
diff --git a/build.gradle b/build.gradle
index e1904925ef..d91c0724bc 100644
--- a/build.gradle
+++ b/build.gradle
@@ -92,6 +92,7 @@ subprojects {
 
     version = '4.1.3-SNAPSHOT'
     ext {
+        bouncyCastleVersion = '1.64'
         commonsCodecVersion = '1.14'
         commonsCompressVersion = '1.20'
         commonsMathVersion = '3.6.1'
@@ -241,7 +242,7 @@ project('ooxml') {
         implementation "org.apache.commons:commons-math3:${commonsMathVersion}"
         implementation "org.apache.commons:commons-compress:${commonsCompressVersion}"
         implementation 'org.apache.santuario:xmlsec:2.1.2'
-        implementation 'org.bouncycastle:bcpkix-jdk15on:1.62'
+        implementation "org.bouncycastle:bcpkix-jdk15on:${bouncyCastleVersion}"
         implementation 'com.github.virtuald:curvesapi:1.06'
         implementation 'com.zaxxer:SparseBitSet:1.2'
 
diff --git a/build.xml b/build.xml
index 7b54e82ce3..e31ab34ed7 100644
--- a/build.xml
+++ b/build.xml
@@ -225,12 +225,12 @@ under the License.
     <!-- xml signature libs -->
     <property name="dsig.xmlsec.jar" location="${compile.lib}/xmlsec-2.1.2.jar"/>
     <property name="dsig.xmlsec.url" value="${repository.m2}/maven2/org/apache/santuario/xmlsec/2.1.2/xmlsec-2.1.2.jar"/>
-    <property name="dsig.bouncycastle-prov.jar" location="${compile.lib}/bcprov-ext-jdk15on-1.62.jar"/>
-    <property name="dsig.bouncycastle-prov.url" value="${repository.m2}/maven2/org/bouncycastle/bcprov-ext-jdk15on/1.62/bcprov-ext-jdk15on-1.62.jar"/>
-    <property name="dsig.bouncycastle-pkix.jar" location="${compile.lib}/bcpkix-jdk15on-1.62.jar"/>
-    <property name="dsig.bouncycastle-pkix.url" value="${repository.m2}/maven2/org/bouncycastle/bcpkix-jdk15on/1.62/bcpkix-jdk15on-1.62.jar"/>
-    <property name="dsig.sl4j-api.jar" location="${compile.lib}/slf4j-api-1.7.26.jar"/>
-    <property name="dsig.sl4j-api.url" value="${repository.m2}/maven2/org/slf4j/slf4j-api/1.7.26/slf4j-api-1.7.26.jar"/>
+    <property name="dsig.bouncycastle-prov.jar" location="${compile.lib}/bcprov-ext-jdk15on-1.64.jar"/>
+    <property name="dsig.bouncycastle-prov.url" value="${repository.m2}/maven2/org/bouncycastle/bcprov-ext-jdk15on/1.64/bcprov-ext-jdk15on-1.64.jar"/>
+    <property name="dsig.bouncycastle-pkix.jar" location="${compile.lib}/bcpkix-jdk15on-1.64.jar"/>
+    <property name="dsig.bouncycastle-pkix.url" value="${repository.m2}/maven2/org/bouncycastle/bcpkix-jdk15on/1.64/bcpkix-jdk15on-1.64.jar"/>
+    <property name="dsig.sl4j-api.jar" location="${compile.lib}/slf4j-api-1.7.30.jar"/>
+    <property name="dsig.sl4j-api.url" value="${repository.m2}/maven2/org/slf4j/slf4j-api/1.7.30/slf4j-api-1.7.30.jar"/>
 
     <!-- svg/batik libs - not part of the distribution -->
     <property name="svg.batik-all.url" value="${repository.m2}/maven2/org/apache/xmlgraphics/batik-all/1.11/batik-all-1.11.jar"/>
@@ -325,10 +325,10 @@ under the License.
     <property name="halt.on.test.failure" value="true"/>
 
     <!-- helper jars for pgp signing, building and nexus staging -->
-    <property name="dist.bouncycastle-prov.jar" location="${compile.lib}/bcprov-ext-jdk15on-1.62.jar"/>
-    <property name="dist.bouncycastle-prov.url" value="${repository.m2}/maven2/org/bouncycastle/bcprov-ext-jdk15on/1.62/bcprov-ext-jdk15on-1.62.jar"/>
-    <property name="dist.bouncycastle-bcpg.jar" location="${compile.lib}/bcpg-jdk15on-1.62.jar"/>
-    <property name="dist.bouncycastle-bcpg.url" value="${repository.m2}/maven2/org/bouncycastle/bcpg-jdk15on/1.62/bcpg-jdk15on-1.62.jar"/>
+    <property name="dist.bouncycastle-prov.jar" location="${compile.lib}/bcprov-ext-jdk15on-1.64.jar"/>
+    <property name="dist.bouncycastle-prov.url" value="${repository.m2}/maven2/org/bouncycastle/bcprov-ext-jdk15on/1.64/bcprov-ext-jdk15on-1.64.jar"/>
+    <property name="dist.bouncycastle-bcpg.jar" location="${compile.lib}/bcpg-jdk15on-1.64.jar"/>
+    <property name="dist.bouncycastle-bcpg.url" value="${repository.m2}/maven2/org/bouncycastle/bcpg-jdk15on/1.64/bcpg-jdk15on-1.64.jar"/>
     <property name="dist.commons-openpgp.jar" location="${compile.lib}/commons-openpgp-1.0-SNAPSHOT.jar"/>
     <property name="dist.commons-openpgp.url" value="https://repository.apache.org/content/groups/snapshots/org/apache/commons/commons-openpgp/1.0-SNAPSHOT/commons-openpgp-1.0-20190121.221905-12.jar"/>
     <property name="dist.nexus-staging.jar" location="${compile.lib}/nexus-staging-ant-tasks-1.6.3-uber.jar"/>
@@ -718,10 +718,11 @@ under the License.
                 <include name="bc*jdk15on-1.5*.jar"/>
                 <include name="bc*jdk15on-1.60*.jar"/>
                 <include name="bc*jdk15on-1.61*.jar"/>
+                <include name="bc*jdk15on-1.62*.jar"/>
                 <include name="batik-all-1.10.jar"/>
                 <include name="slf4j-api-1.7.7.jar"/>
-                <include name="slf4j-api-1.7.12.jar"/>
-                <include name="slf4j-api-1.7.25.jar"/>
+                <include name="slf4j-api-1.7.1*.jar"/>
+                <include name="slf4j-api-1.7.2*.jar"/>
             </fileset>
         </delete>
 
diff --git a/sonar/ooxml/pom.xml b/sonar/ooxml/pom.xml
index 9a48891b08..4d8811d57b 100644
--- a/sonar/ooxml/pom.xml
+++ b/sonar/ooxml/pom.xml
@@ -137,12 +137,12 @@
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcpkix-jdk15on</artifactId>
-            <version>1.62</version>
+            <version>1.64</version>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
             <artifactId>bcprov-jdk15on</artifactId>
-            <version>1.62</version>
+            <version>1.64</version>
         </dependency>
         <dependency>
             <groupId>org.apache.santuario</groupId>
diff --git a/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java b/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
index 8f81566566..c4f25f1222 100644
--- a/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
+++ b/src/ooxml/java/org/apache/poi/poifs/crypt/dsig/SignatureInfo.java
@@ -148,9 +148,9 @@ import org.w3c.dom.events.EventTarget;
  * <p>To use SignatureInfo and its sibling classes, you'll need to have the following libs
  * in the classpath:</p>
  * <ul>
- * <li>BouncyCastle bcpkix and bcprov (tested against 1.62)</li>
+ * <li>BouncyCastle bcpkix and bcprov (tested against 1.64)</li>
  * <li>Apache Santuario "xmlsec" (tested against 2.1.2)</li>
- * <li>and slf4j-api (tested against 1.7.26)</li>
+ * <li>and slf4j-api (tested against 1.7.30)</li>
  * </ul>
  */
 public class SignatureInfo implements SignatureConfigurable {