[JENKINS-68662] Rewrite PEMHelper to use BouncyCastle APIs

[jmdesprez]

Updating the plugin to use org.jenkins-ci.plugins:bouncycastle-api will give a more consistent result when running on a FIPS OS.
See this ticket for more details.

This have to be merged after migrating the module to a plugin

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests - that demonstrates feature works or fixes the issue

[jtnord]

is there a test that shows we can still read files written before the migration?

[jmdesprez]

is there a test that shows we can still read files written before the migration?

@jtnord Tests still use the old files src/test/resources/private-key-pcks1.pem and src/test/resources/private-key-pcks8.pem but I don't know if this is good enough, especially since I don't know how these files were generated. I can use the old version of the plugin to generate a file if needed.

[jtnord]

is there a test that shows we can still read files written before the migration?

@jtnord Tests still use the old files src/test/resources/private-key-pcks1.pem and src/test/resources/private-key-pcks8.pem but I don't know if this is good enough, especially since I don't know how these files were generated. I can use the old version of the plugin to generate a file if needed.

if they exist and are used that should be good enough.

[jmdesprez]

is there a test that shows we can still read files written before the migration?

@jtnord Tests still use the old files src/test/resources/private-key-pcks1.pem and src/test/resources/private-key-pcks8.pem but I don't know if this is good enough, especially since I don't know how these files were generated. I can use the old version of the plugin to generate a file if needed.

if they exist and are used that should be good enough.

Yep, org.jenkinsci.main.modules.instance_identity.ReadWriteKeyTest#testReadIdentityPKCS1vsPKCS8 reads both files, decodes, then compares encoded public and private keys

[jglick]

@jtnord you need to block this release from the update center as in jenkins-infra/update-center2#594 as it is not a plugin until jenkinsci/jenkins#6585 is released, and even then this release will be exposed to older cores.

[jtnord]

@jtnord you need to block this release from the update center as in jenkins-infra/update-center2#594 as it is not a plugin until jenkinsci/jenkins#6585 is released, and even then this release will be exposed to older cores.

👍 jenkins-infra/update-center2#601