asmhatre/javademos
1
0
Fork 0
Code Actions Activity

Add pem-api module: PEMDecoder/PEMEncoder (JEP 538 preview on JDK 27, JEP 542 final in JDK 28) for JWT keys, TLS, encrypted keys and BouncyCastle migration

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01CifR2BE7PBvRy5hT8TS9oz
This commit is contained in:
asmhatre
2026-10-26 01:50:05 +00:00
co-authored by Claude Sonnet 5.5
parent c3cc57f482
commit 2e25042a68
34 changed files with 895 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pem-api/README.md
+23
View File
@@ -0,0 +1,23 @@
# pem-api
Companion code for the ankurm.com article **PEM Encodings in Java (JEP 538 / JEP 542): Read and Write Keys and Certificates Without BouncyCastle**.
`java.security.PEMDecoder` / `PEMEncoder` were previewed in JDK 25 (JEP 470) and 26 (JEP 524), and are a **third preview in JDK 27 (JEP 538)**,
so JDK 27 needs `--enable-preview`. JEP 542 finalizes the API in JDK 28 (targeted; not GA until March 2027). The scripts run on JDK 27.0.1 (Temurin) and on the JDK 28 early-access build 21 (no flag).
| File | What it shows | Output |
|---|---|---|
| `src/RoundTrip.java` | decode / encode keys and certificates, CRLF line endings, what untyped `decode` returns | `output/01-round-trip.txt` |
| `src/JwtSigning.java` | RS256 / ES256 / EdDSA signing with keys from PEM, the ES256 DER vs R&#124;&#124;S trap | `output/02-jwt-signing.txt` |
| `src/TlsFromPem.java` | key + certificate chain + CA from PEM into an `SSLContext`, a local HTTPS server and client | `output/03-tls.txt` |
| `src/EncryptedKeys.java` | write / read encrypted PKCS#8, choose algorithm and cost, wrong password, OpenSSL files | `output/04-encrypted.txt` |
| `src/Failures.java` | wrong target class, SEC1 `EC PRIVATE KEY`, malformed text, bundles | `output/05-failures.txt` |
| `src/Migration.java` | the same jobs with BouncyCastle `bcpkix` 1.86, Spring Security 7.1.2 `RsaKeyConverters`, and the JDK | `output/06-migration.txt` |
| (script) | compile without `--enable-preview`; run without it | `output/07-preview-flag.txt` |
| (script) | the same demos on JDK 28 EA, no flag, diffed against the JDK 27 run | `output/08-jdk28-final.txt` |
```bash
JDK27=/path/to/jdk-27 JDK28=/path/to/jdk-28-ea ./run.sh # JDK28 is optional; needs Maven Central once, for bcpkix and spring-security-core
```
`fixtures/` holds throw-away OpenSSL-generated keys and certificates (see `fixtures/README.md`). Output is byte-stable; the ECDSA DER length (random, 70-72) is printed as a range check for that reason.