Add pem-api module: PEMDecoder/PEMEncoder (JEP 538 preview on JDK 27, JEP 542 final in JDK 28) for JWT keys, TLS, encrypted keys and BouncyCastle migration

Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CifR2BE7PBvRy5hT8TS9oz
2026-10-26 01:50:05 +00:00
parent c3cc57f482
commit 2e25042a68
34 changed files with 895 additions and 0 deletions
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# PEM encodings in Java: JEP 538 (third preview, JDK 27) -> JEP 542 (final, JDK 28).
+# Regenerates every file in output/.   JDK27=/path/to/jdk27 JDK28=/path/to/jdk28-ea ./run.sh
+set -uo pipefail
+unset JAVA_TOOL_OPTIONS
+HERE="$(cd "$(dirname "$0")" && pwd)"
+JDK27="${JDK27:?set JDK27}"; JDK28="${JDK28:-}"
+OUT="$HERE/output"; mkdir -p "$OUT"; B="$(mktemp -d)"; trap 'rm -rf "$B"' EXIT
+cd "$HERE"
+jv() { "$1/bin/java" -version 2>&1 | sed -n 2p | sed 's/.*(build \(.*\))/\1/'; }
+
+# comparison libraries (BouncyCastle bcpkix, spring-security-core) -> target/lib
+[ -d target/lib ] || mvn -q -B dependency:copy-dependencies -DoutputDirectory=target/lib -DincludeScope=compile >/dev/null
+CP_LIBS="$(ls target/lib/*.jar | tr '\n' ':')"
+
+P27="--enable-preview --release 27"
+mkdir -p "$B/c27"; "$JDK27/bin/javac" $P27 -cp "$CP_LIBS" -d "$B/c27" src/*.java 2>&1 | grep -v '^Note:'
+run27() { echo "\$ java --enable-preview -cp ... $1     ($(jv "$JDK27"))"; "$JDK27/bin/java" --enable-preview -Dfixtures=fixtures -cp "$B/c27:$CP_LIBS" "$1" 2>&1; echo "exit=$?"; }
+
+{ run27 RoundTrip; } > "$OUT/01-round-trip.txt"
+{ run27 JwtSigning; } > "$OUT/02-jwt-signing.txt"
+{ run27 TlsFromPem; } > "$OUT/03-tls.txt"
+{ run27 EncryptedKeys; } > "$OUT/04-encrypted.txt"
+{ run27 Failures; } > "$OUT/05-failures.txt"
+{ run27 Migration; } > "$OUT/06-migration.txt"
+
+# 07 - the preview flag: what you see without it
+{
+  echo "\$ javac RoundTrip.java Fx.java   (no flags)     ($(jv "$JDK27"))"
+  mkdir -p "$B/n"; "$JDK27/bin/javac" -d "$B/n" src/Fx.java src/RoundTrip.java 2>&1; echo "exit=${PIPESTATUS[0]}"
+  echo
+  echo "\$ java RoundTrip   (compiled with --enable-preview, run without it)     ($(jv "$JDK27"))"
+  "$JDK27/bin/java" -cp "$B/c27" RoundTrip 2>&1 | head -3
+  echo
+  echo "\$ javac --enable-preview --release 27 RoundTrip.java Fx.java"
+  mkdir -p "$B/p"; "$JDK27/bin/javac" --enable-preview --release 27 -Xlint:preview -d "$B/p" src/Fx.java src/RoundTrip.java 2>&1 | head -12; echo "exit=${PIPESTATUS[0]}"
+} > "$OUT/07-preview-flag.txt"
+
+# 08 - the same demos on the JDK 28 early-access build, with NO preview flag (JEP 542 finalizes the API)
+if [ -n "$JDK28" ]; then
+  mkdir -p "$B/c28"
+  {
+    echo "\$ javac src/{Fx,RoundTrip,JwtSigning,TlsFromPem,EncryptedKeys,Failures}.java   (no flags)     ($(jv "$JDK28"))"
+    "$JDK28/bin/javac" -d "$B/c28" src/Fx.java src/RoundTrip.java src/JwtSigning.java src/TlsFromPem.java src/EncryptedKeys.java src/Failures.java 2>&1; echo "exit=${PIPESTATUS[0]}"
+    for c in RoundTrip JwtSigning TlsFromPem EncryptedKeys Failures; do
+      echo; echo "\$ java $c   (no flags)"
+      "$JDK28/bin/java" -Dfixtures=fixtures -cp "$B/c28" $c > "$B/28-$c.txt" 2>&1; echo "exit=$?"
+      "$JDK27/bin/java" --enable-preview -Dfixtures=fixtures -cp "$B/c27" $c > "$B/27-$c.txt" 2>&1
+      if diff -q "$B/27-$c.txt" "$B/28-$c.txt" >/dev/null; then echo "output identical to the JDK 27 run"; else echo "output DIFFERS from the JDK 27 run:"; diff "$B/27-$c.txt" "$B/28-$c.txt" | head -20; fi
+    done
+  } > "$OUT/08-jdk28-final.txt"
+fi
+echo done