OPSC-17995 Upgrade commons-compress 1.10 -> 1.27.1 to fix CVEs, bump version to 2.7.0.13 - #18
Open
orion104 wants to merge 5 commits into
Open
OPSC-17995 Upgrade commons-compress 1.10 -> 1.27.1 to fix CVEs, bump version to 2.7.0.13#18orion104 wants to merge 5 commits into
orion104 wants to merge 5 commits into
Conversation
added 5 commits
August 2, 2026 11:11
…version to 2.7.0.13
… to skip antlr_gen
NoVerifyX509TrustManager was removed by the SNI commit (f6ee772) but ripcord 6.8.x SslUtils.py still imports it. Reverting until SNI support is properly integrated as part of OPSC-16690.
There was a problem hiding this comment.
Pull request overview
This PR updates the Jython standalone build to address reported CVEs by upgrading the bundled commons-compress dependency, and includes related build/CI and SSL/ANTLR-generation adjustments needed to produce and publish the rebuilt artifact.
Changes:
- Upgrade embedded
commons-compressfrom 1.10 to 1.27.1 in the Ant build/jarjar packaging. - Add a Jenkins pipeline to build and upload the rebuilt
jython-standaloneartifact. - Commit pre-generated ANTLR lexer/token sources under
gensrc/and update SSL implementation details.
Reviewed changes
Copilot reviewed 8 out of 15 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
build.xml |
Bumps version, updates dist.dir, and upgrades bundled commons-compress jar in classpath and jarjar packaging. |
maven/build.xml |
Updates the Maven bundle version used when producing/publishing Maven artifacts. |
Lib/ssl.py |
Refactors SSL engine creation and related SSL capability constants/behavior. |
Lib/_sslcerts.py |
Updates trust manager construction and introduces a “no-verify” trust manager for CERT_NONE. |
Lib/test/test_ssl.py |
Adjusts SNI gating for an SSL algorithm verification test. |
Jenkinsfile |
Adds CI pipeline steps for building jython-standalone and uploading to Artifactory. |
gensrc/org/python/antlr/PythonLexer.java |
Adds committed, pre-generated ANTLR lexer source. |
gensrc/org/python/antlr/Python.tokens |
Adds committed, pre-generated ANTLR token definitions. |
gensrc/org/python/antlr/PythonPartial.tokens |
Adds committed, pre-generated ANTLR partial token definitions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| <pathelement path="${extlibs.dir}/netty-codec-4.1.4.Final.jar"/> | ||
| <pathelement path="${extlibs.dir}/netty-common-4.1.4.Final.jar"/> | ||
| <pathelement path="${extlibs.dir}/netty-handler-4.1.4.Final.jar"/> | ||
| <pathelement path="${extlibs.dir}/netty-handler--4.1.4.Final.jar"/> |
Comment on lines
+87
to
+88
| <property name="jython.version" value="2.7.0.14"/> | ||
| <property name="jython.version.noplus" value="2.7.0.14"/> |
| <property file="${basedir}/default.properties"/> | ||
|
|
||
| <property name="project.version" value="2.7.0.13"/> | ||
| <property name="project.version" value="2.7.0.14"/> |
Comment on lines
329
to
333
| def getPrivateKey(self, alias): | ||
| for key_manager in self.key_managers: | ||
| private_key = key_manager.getPrivateKey(alias) | ||
| private_key = keyManager.getPrivateKey(alias) | ||
| if private_key: | ||
| return private_key |
Comment on lines
+407
to
+416
| class NoVerifyX509TrustManager(X509TrustManager): | ||
|
|
||
| def __init__(self, trust_managers): | ||
| self._trust_manager = CompositeX509TrustManager(trust_managers) | ||
| def checkClientTrusted(self, chain, auth_type): | ||
| pass | ||
|
|
||
| def engineInit(self, arg): | ||
| def checkServerTrusted(self, chain, auth_type): | ||
| pass | ||
|
|
||
| def engineGetTrustManagers(self): | ||
| return [self._trust_manager] | ||
| def getAcceptedIssuers(self): | ||
| return None |
Comment on lines
+1041
to
1045
| def _createSSLEngine(self, addr, hostname=None, cert_file=None, key_file=None): | ||
| trust_managers = [NoVerifyX509TrustManager()] | ||
| if self.verify_mode == CERT_REQUIRED: | ||
| tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()) | ||
| tmf.init(self._trust_store) |
Comment on lines
561
to
564
| self.engine = self._context._createSSLEngine( | ||
| addr, self.server_hostname, | ||
| cert_file=getattr(self, "certfile", None), key_file=getattr(self, "keyfile", None), | ||
| server_side=self.server_side) | ||
| cert_file=getattr(self, "certfile", None), key_file=getattr(self, "keyfile", None)) | ||
| self.engine.setUseClientMode(not self.server_side) |
| super(input,state); | ||
|
|
||
| } | ||
| public String getGrammarFileName() { return "/Users/orion.moore/apps/code/jython/grammar/Python.g"; } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the issue
Customer (Equifax) reported 5 CVEs in OpsCenter caused by the
commons-compress 1.10jar bundled insidejython-standalone, tracked in OPSC-17995.Because commons-compress is embedded inside the jython-standalone fat jar, it cannot be excluded via Gradle. The fix requires rebuilding jython-standalone with an updated commons-compress version and publishing a new artifact.
What does this PR fix and why was it fixed
commons-compressfrom 1.10 → 1.27.1 (resolves all 5 reported CVEs, well past the required minimum of 1.21)The new
2.7.0.13artifact is consumed by riptano/ripcord in the companion PR for OPSC-17995.