jdk14 patchset 4-pre1

[Alexey Zelkin]

hi,

On Thu, Sep 11, 2003 at 12:57:24AM +0300, Panagiotis Astithas wrote:
> Greg Lewis wrote:
> > On Wed, Sep 10, 2003 at 05:16:38PM +0300, Panagiotis Astithas wrote:
> > 
> >>since I will be making a test build of the 4-pre1 patchset, I will grab 
> >>the opportunity to ask about the Sun-provided SCSL security stuff.
> >>
> >>When I get to the page to download the sources, besides the usual
> >>j2sdk-1_4_1-src-scsl.zip, I can download another file, called 
> >>j2sdk-sec-1_4_1-src-scsl.zip. The latter contains cryptographic code, 
> >>but I am puzzled about its purpose. For all I can say, this contains 
> >>source code for classes that are built with the port anyway, but perhaps 
> >>this other bundle has some benefits, such as stronger encryption? If 
> >>this is so, how could we include it in the build? The bundle contains 
> >>only java files, plus a Windows C file, that I believe we can ignore. 
> >>Also, will the final binary release of 1.4.1 contain these cryptography 
> >>extensions, or the current ones?
> > 
> > 
> > As I understand it, these are the source files for the bundled
> > crytographic JARs, in case you want to compile them yourself.  I don't
> > believe the source code provides anything the bundled versions don't.
> 
> Correct me if I'm wrong, but the standard bundle seems to contain only 
> stub classes, while the security bundle contains concrete 
> implementations. For instance, I look for Cipher.java in the standard 
> bundle and I can find it under a directory blah/stub/blah, containing a 
> comment on top about export restrictions and such. Am I missing 
> something here?
> 
> Of course, then I have the question how the heck my secure web 
> application is working all this time :-)
 
I hit this issue some time ago too :-)

Actually, due to export restrictions, crypto stuff is distributed by
compiled JAR, and in sources only stubs to allow crypto related stuff
be compiled.  After build complete, JAR with stubs is simply replaced
with real one, IIRC.