Add an application to list providers capabilities

[emaldona]

List the capabilities of the "Mozilla-JSS" and other installed providers.
I have such an application in my own fork of jss in the capabilities branch.
See it at
https://github.com/emaldona/capabilities

Before submitting a pull request it would be good to have a discussion here.
A few things to come to my mind:
Is this useful at all?
Should it be a sample or some other stand-alone application? (Hard to do it as a test)
Is what yo see too complex and it should be made simpler?

[cipherboy]

I think this would be interesting as it'd let us see what features the JDK implements (at different versions) and see what else we'd need to add in, to reach compatibility. Since we're attempting to be a default crypto provider, it would be nice to ensure we're mostly close to what the JDK provides. Hopefully other packages written to the JDK provider can have similar algorithms available under JSS and behave well. Large gaps in coverage are likely an issue (such as #341 and #242).

I do agree that listing seems better than a test.

Do you have sample output you could share? I'm curious where we're at currently.

[emaldona]

This tar has the sample out you asked for
listings.zip

[emaldona]

unzip listing.zip; tar xvf listings.tar should extract them.

[cipherboy]

Hmm... For the alias entries, is there any chance you could show them under the section and perhaps omit them from the brief listings?

I'm thinking something like:

Signature.SHA512withEC
    alias: Alg.Alias.Signature.SHA512/EC
    alias: Alg.Alias.Signature.SHA-512/EC
    ...
...

And perhaps also sort the top-level algorithms and perhaps interior aliases for stability?

I realize its a lot of work (happy to submit PR to your tool if you're interested) -- but I think that will make the output much more comparable. As it is, especially with the OID aliases, it is really hard to compare e.g., Mozilla-JSS against the SunJSSE provider. This might also identify that we're using different base algorithm names (perhaps they use SHA-512/EC by default and we use SHA512withEC, I dunno), but at least we might be able to find them more easily and see if we're missing any aliases this way.

Did you have something in mind? :-)

My 2c. at any rate.

[emaldona]

somewhere you wrote this
cd build && ./run_test.sh org,mozilla.test.CapabilityList (doing export JAVA_SECURITY_CFG='')
Tried but it doesn't work for me.

[cipherboy]

@emaldona Did you make sure you built the new commit first? E.g.:

git clone https://github.com/cipherboy/jss
cd jss && git checkout capabilities-cmake-build
cd build
cmake .. && make
./run_test.sh org.mozilla.jss.tests.CapabilitiesList

Since the file moved, you'd have to rebuild JSS first before this works.

(Edit Dropped the S in testS on the class path above).

[emaldona]

Let me try it in two steps then.

[emaldona]

Failed, it can't find or load the main class. Let's discuss it one IRC.

[emaldona]

It's working now. I did "diff -r ~/one/ listings" where the first is listings before the second commit and the second is one done in the capabilities-change-output branch. Here are the results
oneVSTwoListings.txt

[emaldona]

As we discussed earlier on IRC our changes work as expected on fedora 34, rawhide, openSUSE Tumbleweed, and ubuntu. I was finally able to get it working again on debian 10 so I could get the minimally required version of cmake. Activating the testing repository for that is a mess, several methods documented or all of them take many steps. I ended up having to get nss and other packages updated to testing repo. I can see why debian is not very popular. The debian based distros are more convenient both for end-users and developers. Enjoy the weekend, Elio

…

On Thu, May 13, 2021 at 10:04 AM Alexander Scheel ***@***.***> wrote: @emaldona <https://github.com/emaldona> Did you make sure you built the new commit first? E.g.: git clone https://github.com/cipherboy/jss cd jss && git checkout capabilities-cmake-build cd build cmake .. && make ./run_test.sh org.mozilla.jss.test.CapabilityList Since the file moved, you'd have to rebuild JSS first before this works. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#693 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACZPFVWMVT5QHTOKT5VGQPLTNQBBNANCNFSM44YZJGYA> .

[cipherboy]

I think this can be closed as #704 has merged.