springboot tests on top of wolfjsse#7

Open

JeremiahM37 wants to merge 1 commit intowolfSSL:mainfrom

JeremiahM37:spring-boot-tests

JeremiahM37 commented Jan 28, 2026 •

edited

Loading

Added springboot test image for wolfjsse FIPS

Requires wolfSSL/wolfssljni#310 to be merged for the tests to pass which I'm still cleaning up a bit and should be done soon.

All tests that are skipped are due to fips restrictions as every single test passes with non-fips.

JeremiahM37 assigned cconlon

cconlon requested a review from Copilot

February 3, 2026 23:24

Copilot started reviewing on behalf of cconlon

February 3, 2026 23:24

Copilot AI reviewed

View reviewed changes

Copilot AI left a comment

Pull request overview

This pull request adds Spring Boot SSL test infrastructure for wolfJSSE FIPS mode. It creates a Docker-based test environment that patches Spring Boot 3.4.1 to work with wolfJSSE in FIPS mode, handling FIPS-specific requirements such as WKS keystore format, FIPS-compliant passwords (minimum 14 characters), and CA-signed certificates. The tests require wolfssljni PR #310 to pass, and many tests are skipped due to FIPS restrictions on certain cryptographic algorithms like DSA, EdDSA, and PBES2.

Changes:

Added build script for creating Spring Boot test Docker images with wolfJSSE FIPS support
Implemented comprehensive patching script to modify Spring Boot source code for FIPS compliance
Created multi-stage Dockerfile with test orchestration and WKS keystore generation utilities

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 8 comments.

File	Description
build.sh	Shell script to build the Spring Boot test Docker image with command-line options for customization
apply_spring_fips_fixes.sh	Comprehensive bash script that patches Spring Boot source code to support wolfJSSE FIPS requirements
Dockerfile	Multi-stage Docker build that clones Spring Boot, applies patches, and sets up test environment with proper keystores
README.md	Repository documentation (currently duplicates root README)

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/Dockerfile Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/Dockerfile Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/Dockerfile Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/Dockerfile Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/Dockerfile Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/README.md Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/Dockerfile Outdated Show resolved Hide resolved

JeremiahM37 force-pushed the spring-boot-tests branch 2 times, most recently from fa07559 to 7b87e1f Compare

February 9, 2026 16:26

cconlon requested changes

View reviewed changes

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated Show resolved Hide resolved

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/Dockerfile Show resolved Hide resolved

cconlon assigned JeremiahM37 and unassigned cconlon

JeremiahM37 added a commit to JeremiahM37/wolfssl-containers that referenced this pull request


          Address PR wolfSSL#7 review comments: re-enable SslInfoTests and SSL …

49f2777

…reload

- Re-enable SslInfoTests (all 6 tests): use faketime+openssl to generate
  self-signed certs with exact validity dates, WksUtil to create WKS
  keystores, and sed/perl to patch test assertions for WKS structure
- Re-enable shouldUpdateSslWhenReloadingSslBundles: replace ED25519 certs
  with RSA, fix PemSslStoreBundle null password and getKeyStorePassword
- Fix password replacement to catch =pwd" property format (fixes
  Cassandra, MongoReactive, RabbitMQ SSL bundle tests)
- Add CA cert extensions (basicConstraints, keyUsage) per review feedback
- Replace python3 patching with sed/perl (removes python3 dependency)
- Add detailed root cause comments for all disabled tests
- Improve Section 9 Netty/InsecureTrustManagerFactory documentation

Test results: 392 tests, 277 passed, 0 failed, 115 skipped

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

JeremiahM37 force-pushed the spring-boot-tests branch 2 times, most recently from f4572fc to 75a585e Compare

February 23, 2026 06:50

JeremiahM37 assigned cconlon and unassigned JeremiahM37

JeremiahM37 force-pushed the spring-boot-tests branch from 75a585e to 98cb4be Compare

February 25, 2026 17:10

JeremiahM37 added a commit to JeremiahM37/wolfssl-containers that referenced this pull request


          Address PR wolfSSL#7 review comments: re-enable SslInfoTests and SSL …

e0e3681

…reload

- Re-enable SslInfoTests (all 6 tests): use faketime+openssl to generate
  self-signed certs with exact validity dates, WksUtil to create WKS
  keystores, and sed/perl to patch test assertions for WKS structure
- Re-enable shouldUpdateSslWhenReloadingSslBundles: replace ED25519 certs
  with RSA, fix PemSslStoreBundle null password and getKeyStorePassword
- Fix password replacement to catch =pwd" property format (fixes
  Cassandra, MongoReactive, RabbitMQ SSL bundle tests)
- Add CA cert extensions (basicConstraints, keyUsage) per review feedback
- Replace python3 patching with sed/perl (removes python3 dependency)
- Add detailed root cause comments for all disabled tests
- Improve Section 9 Netty/InsecureTrustManagerFactory documentation

Test results: 392 tests, 277 passed, 0 failed, 115 skipped

cconlon requested changes

View reviewed changes

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh

+                      fi
+                  done
+              }

Member

cconlon Mar 6, 2026

Extra blank line

Author

JeremiahM37 Mar 9, 2026

Fixed

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated

+              fi
+              disable_test_method "${BOOT_TEST}/ssl/pem/PemSslStoreBundleTests.java" \
+                  "createWithDetailsWhenHasKeyStoreDetailsCertAndEncryptedKey" "wolfJCE FIPS: PBES2 encrypted key"
+              # RE-ENABLED after WKS/FIPS password patch:

Member

cconlon Mar 6, 2026

Comments about tests re-enabled are not needed

Author

JeremiahM37 Mar 9, 2026

Fixed

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated

+              # used ED25519 certs (not FIPS-approved). The Dockerfile now replaces 1.crt/1.key
+              # and 2.crt/2.key with RSA equivalents. The test also uses TrustAllStrategy on the
+              # client side (Apache HttpClient), which works with wolfJSSE for Tomcat tests.
+              # RE-ENABLED - ED25519 certs replaced with RSA in Dockerfile.

Member

cconlon Mar 6, 2026

This comment can be reworded to just state the current facts, not referencing previous state of review.

Author

JeremiahM37 Mar 9, 2026

Fixed

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated

+              # 1. Replaces PEM files with CA-signed versions (Dockerfile)
+              # 2. Patches TrustSelfSignedStrategy -> TrustAllStrategy (Section 8)
+              # 3. Converts client keystores from PKCS12 to WKS (Sections 3-4)
+              # RE-ENABLED - the "inline PEM" label was incorrect; all PEM data is from files.

Member

cconlon Mar 6, 2026

We can remove "RE-ENABED". Future engineers won't know what the previous behavior was, or history around it.

Author

JeremiahM37 Mar 9, 2026

Fixed

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated

+              # and verify their structure. No TLS connections are made. Previously disabled for
+              # HMAC password length errors, but Section 1 (password replacement) and Section 2
+              # (null password handling) should now handle the WKS password requirements.
+              # RE-ENABLED - password handling fixes should resolve WKS keystore creation.

Member

cconlon Mar 6, 2026

Same here, don't need RE-ENABLED wording

Author

JeremiahM37 Mar 9, 2026

Fixed

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated

+                  sed -i 's/isEqualTo("secret2")/isEqualTo("'"${FIPS_PASSWORD}"'")/g' "$SSL_AUTO_TESTS"
+                  echo "  Fixed type and password assertions in SslAutoConfigurationTests.java"
+              fi
+              # RE-ENABLED: sslBundlesCreatedWithCertificates and sslBundlesCreatedWithCustomSslBundle

Member

cconlon Mar 6, 2026

Same here, don't need RE-ENABLED wording

Author

JeremiahM37 Mar 9, 2026

Fixed

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated

+              disable_test_method "${AUTOCONFIG_TEST}/ssl/SslPropertiesBundleRegistrarTests.java" \
+                  "shouldUseResourceLoader" "FIPS: JKS requires SUN provider"
+              # Cassandra, MongoReactive, and RabbitMQ enableSslWithBundle tests

Member

cconlon Mar 6, 2026

Looks like we can get rid of this comment block

Author

JeremiahM37 Mar 9, 2026

Fixed

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/apply_spring_fips_fixes.sh Outdated

+                  "shouldUseSslWhenRocketServerSslIsConfigured" \
+                  "wolfJSSE FIPS: JKS test resource not converted to WKS"
+              # MongoDB non-reactive configuresSslWithBundle: RE-ENABLED

Member

cconlon Mar 6, 2026

Looks like we can get rid of this comment block

Author

JeremiahM37 Mar 9, 2026

Fixed

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/FIPS_TEST_RESTRICTIONS.md Outdated

+              | Error Code | Name | Meaning |
+              |------------|------|---------|
+              | -313 | FATAL_ERROR | Certificate validation failed at native wolfSSL level |

Member

cconlon Mar 6, 2026

Native wolfSSL -313 is a "recvd alert fatal error", which may happen for a variety of reasons. Pinning that to cert validation logic here seems potentially misleading.

Author

JeremiahM37 Mar 9, 2026 •

edited

Loading

Removed this file, the comments in the patch script explain what is disabled and why so this is redundant and outdated.

java/wolfssl-openjdk-fips-root/test-images/spring-boot-tests/PR7_COMMENT_STATUS.txt Outdated

		@@ -0,0 +1,528 @@
		================================================================================
		PR #7 Review Comment Status - wolfSSL/wolfssl-containers

Member

cconlon Mar 6, 2026

This file should not be part of this PR.

Author

JeremiahM37 Mar 9, 2026

Removed

cconlon assigned JeremiahM37 and unassigned cconlon

JeremiahM37 force-pushed the spring-boot-tests branch from 98cb4be to 9cbbd79 Compare

March 9, 2026 15:19

JeremiahM37 assigned cconlon and unassigned JeremiahM37 and cconlon


          Spring Boot wolfJSSE FIPS test suite

846c29c

JeremiahM37 force-pushed the spring-boot-tests branch from 9cbbd79 to 846c29c Compare

March 9, 2026 18:06

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet