Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
org.conscrypt:conscrypt-openjdk-benchmarks
Advanced tools
Conscrypt is a Java Security Provider (JSP) that implements parts of the Java Cryptography Extension (JCE) and Java Secure Socket Extension (JSSE). It uses BoringSSL to provide cryptograhpic primitives and Transport Layer Security (TLS) for Java applications on Android and OpenJDK.
The core SSL engine has borrowed liberally from the Netty project and their
work on netty-tcnative, giving Conscrypt
similar performance.
Homepage: | conscrypt.org |
Mailing List: | conscrypt@googlegroups.com |
NOTE: This section is under construction! Artifacts have not yet been published to the public Maven repositories.
You can download the JARs directly from the Maven repositories.
The OpenJDK artifacts are platform-dependent, since each embeds a native library for a particular platform. We publish artifacts to Maven Central for the following platforms:
Classifier | Description |
---|---|
windows-x86_64 | Windows distribution |
osx-x86_64 | Mac distribution |
linux-x86_64 | Used for Linux |
Use the os-maven-plugin to add the dependency:
<build>
<extensions>
<extension>
<groupId>kr.motd.maven</groupId>
<artifactId>os-maven-plugin</artifactId>
<version>1.4.1.Final</version>
</extension>
</extensions>
</build>
<dependency>
<groupId>org.conscrypt</groupId>
<artifactId>conscrypt-openjdk</artifactId>
<<<<<<< HEAD
<version>1.0.1</version>
=======
<version>1.1.0-SNAPSHOT</version>
>>>>>>> 52c196b8e8cea5b850404bf5eac44c27ca858d2e
<classifier>${os.detected.classifier}</classifier>
</dependency>
Use the osdetector-gradle-plugin (which is a wrapper around the os-maven-plugin) to add the dependency:
buildscript {
repositories {
mavenCentral()
}
dependencies {
classpath 'com.google.gradle:osdetector-gradle-plugin:1.4.0'
}
}
// Use the osdetector-gradle-plugin
apply plugin: "com.google.osdetector"
dependencies {
compile 'org.conscrypt:conscrypt-jdk:1.0.1:' + osdetector.classifier
}
For convenience, we also publish an Uber JAR to Maven Central that contains the shared libraries for all of the published platforms. While the overall size of the JAR is larger than depending on a platform-specific artifact, it greatly simplifies the task of dependency management for most platforms.
To depend on the uber jar, simply use the conscrypt-openjdk-uber
artifacts.
<dependency>
<groupId>org.conscrypt</groupId>
<artifactId>conscrypt-openjdk-uber</artifactId>
<version>1.0.1</version>
</dependency>
dependencies {
compile 'org.conscrypt:conscrypt-jdk-uber:1.0.1'
}
If you are making changes to Conscrypt, see the building instructions.
Here's a quick readers' guide to the code to help folks get started. The high-level modules are Common, Android, OpenJDK, and Platform.
This contains the bulk of the code for both Java and C. This isn't an actual module and builds no artifacts. Rather, the other modules just point to this directory as source.
This module provides the Platform
class for Android and also adds compatibility classes for
supporting various versions of Android. This generates an aar
library artifact.
This modules provides the Platform
class for non-Android (OpenJDK-based) systems. It also provides
a native library loader supports bundling the shared library with the JAR.
This is not an actual module and is not part of the default build. This is used for building Conscrypt as an embedded component of the Android platform.
FAQs
Conscrypt: OpenJDK Benchmarks
We found that org.conscrypt:conscrypt-openjdk-benchmarks demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.