Conscrypt Documentation

Conscrypt's AEAD ciphers do not support incremental processing. Calls to update() will always return null, and input is only processed when doFinal() is called.

Requirement: You must buffer the entire input for each operation before calling doFinal(). For large inputs, you may need to split the data into chunks. Refer to the BoringSSL documentation for safety considerations when chunking AEAD inputs.

To generate and view code coverage numbers, run the tests followed by the jacocoTestReport rule:

./gradlew check jacocoTestReport

The HTML report will be generated at: openjdk/build/reports/jacoco/test/html/index.html

Conscrypt's OAEP ciphers (e.g., RSA/ECB/OAEPWithSHA-256AndMGF1Padding) use the specified named digest for both the main digest and the MGF1 digest. This differs from OpenJDK, which uses SHA-1 for the MGF1 digest.

To ensure maximum compatibility with other providers, use RSA/ECB/OAEPPadding and initialize it with an OAEPParameterSpec to explicitly define the digests.

Conscrypt OpenJDK artifacts are platform-dependent because they embed a native library. To manage this, use the os-maven-plugin to automatically detect the correct classifier for your operating system and architecture.

Supported platforms include:

• linux-x86_64 (Linux x86_64)
• linux-aarch_64 (Linux aarch_64)
• osx-x86_64 (Mac x86_64)
• osx-aarch_64 (Mac aarch_64)
• windows-x86_64 (Windows x86_64)

<build>
  <extensions>
    <extension>
      <groupId>kr.motd.maven</groupId>
      <artifactId>os-maven-plugin</artifactId>
      <version>1.4.1.Final</version>
    </extension>
  </extensions>
</build>

<dependency>
  <groupId>org.conscrypt</groupId>
  <artifactId>conscrypt-openjdk</artifactId>
  <version>2.6.0</version>
  <classifier>${os.detected.classifier}</classifier>
</dependency>

To build Conscrypt from the source repository, use the Gradle wrapper.

To perform a standard build, run:

./gradlew build

To publish the resulting artifacts to your local Maven repository (allowing you to use them as dependencies in your own projects), run:

./gradlew publishToMavenLocal

Building Conscrypt requires the following environment configuration:

Java

• Runtime: You must have Java 11 installed to run Gradle.
• Compiler: Conscrypt is compiled using Java 8 via Gradle's toolchain support. If Java 8 is not present, Gradle may attempt to install it automatically depending on your OS.

Android SDK

• Install the latest Android SDK.
• Set the ANDROID_HOME environment variable to the root of your SDK installation.
  • Example: export ANDROID_HOME=/usr/local/me/Android/Sdk

BoringSSL

• You must first set up the BoringSSL prerequisites.
• Clone BoringSSL and set the BORINGSSL_HOME environment variable to the installation directory.

Conscrypt's OAEP ciphers (e.g., RSA/ECB/OAEPWithSHA-256AndMGF1Padding) use the named digest for both the main digest and the MGF1 digest. This differs from some OpenJDK providers that always use SHA-1 for the MGF1 digest.

To ensure maximum compatibility with other providers, use RSA/ECB/OAEPPadding and initialize it with an OAEPParameterSpec.

When modifying .java, .cc, .h, .cpp, or .c files within the Conscrypt directory (specifically under third_party/java/conscrypt/main_src/), you must use the project's custom formatting script instead of standard global formatters.

Requirements:

• The script only processes files that are currently opened for edit in your version control system (e.g., via g4 edit or hg edit).
• You must run the formatter after making changes but before creating a CL, uploading, or submitting your work.

python3 third_party/java/conscrypt/main_src/fix_format.py

If you want to simplify dependency management and avoid platform-specific classifiers, you can use the conscrypt-openjdk-uber artifact. This Uber JAR contains the shared libraries for all published platforms. Note that the JAR size will be larger than the platform-specific version.

##### Maven
```xml
<dependency>
  <groupId>org.conscrypt</groupId>
  <artifactId>conscrypt-openjdk-uber</artifactId>
  <version>2.6.0</version>
</dependency>

Gradle

dependencies {
  compile 'org.conscrypt:conscrypt-openjdk-uber:2.6.0'
}