Project import generated by Copybara.

.github/workflows/ci.yml

@@ -526,6 +526,10 @@ jobs:
           DIR="$(find m2/org/conscrypt/conscrypt-openjdk-uber -maxdepth 1 -mindepth 1 -type d -print)"
           VERSION="${DIR##*/}"
           TESTJAR="$(find testjar -name '*-tests.jar')"
+          EXTRA_FLAGS=""
+          if [ "${{ matrix.java }}" != "8" ]; then
+            EXTRA_FLAGS="--add-opens=java.base/java.net=ALL-UNNAMED"
+          fi
           # SIGTERM handler, e.g. for when tests hang and time out.
           # Send SIGQUIT to test process to get thread dump, give it
           # a few seconds to complete and then kill it.
@@ -537,7 +541,7 @@ jobs:
             kill -KILL "$TESTPID"
             exit 1
           }
-          java -jar junit-platform-console-standalone.jar execute -cp "$DIR/conscrypt-openjdk-uber-$VERSION.jar${{ matrix.separator }}$TESTJAR" -n='org.conscrypt.ConscryptOpenJdkSuite' --scan-classpath --reports-dir=results --fail-if-no-tests &
+          java $EXTRA_FLAGS -jar junit-platform-console-standalone.jar execute -cp "$DIR/conscrypt-openjdk-uber-$VERSION.jar${{ matrix.separator }}$TESTJAR" -n='org.conscrypt.ConscryptOpenJdkSuite' --scan-classpath --reports-dir=results --fail-if-no-tests &
           case $(uname -s) in
             Darwin|Linux)
               trap dump_threads SIGTERM SIGINT

AndroidManifest_instrumentation_test.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="org.conscrypt.test">
+
+    <uses-sdk android:minSdkVersion="24" android:targetSdkVersion="34" />
+
+    <uses-permission android:name="android.permission.INTERNET" />
+
+    <application android:usesCleartextTraffic="true">
+        <uses-library android:name="android.test.runner" />
+    </application>
+
+    <instrumentation android:name="com.google.android.apps.common.testing.testrunner.Google3InstrumentationTestRunner"
+                     android:targetPackage="org.conscrypt.test"
+                     android:label="Conscrypt Instrumentation Tests"/>
+
+</manifest>

LICENSE

@@ -200,3 +200,57 @@
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
+
+===============================================================================
+
+Path = constants/src/gen/java/cert_verify_proc_blocklist.inc
+
+===============================================================================
+// Copyright 2015 The Chromium Authors
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//    * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//    * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//    * Neither the name of Google LLC nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+===============================================================================
+
+Path = common/src/test/resources/crypto/*
+
+===============================================================================
+Terms Of Use
+
+This software was developed by employees of the National Institute of Standards
+and Technology (NIST), and others. This software has been contributed to the
+public domain. Pursuant to title 15 Untied States Code Section 105, works of
+NIST employees are not subject to copyright protection in the United States and
+are considered to be in the public domain. As a result, a formal license is
+not needed to use this software.
+
+This software is provided "AS IS." NIST MAKES NO WARRANTY OF ANY KIND, EXPRESS,
+IMPLIED OR STATUTORY, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTY OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT AND DATA
+ACCURACY. NIST does not warrant or make any representations regarding the use
+of the software or the results thereof, including but not limited to the
+correctness, accuracy, reliability or usefulness of this software.

README.md

@@ -150,7 +150,7 @@ Use the [os-maven-plugin](https://github.com/trustin/os-maven-plugin) to add the
 <dependency>
   <groupId>org.conscrypt</groupId>
   <artifactId>conscrypt-openjdk</artifactId>
-  <version>2.6.0</version>
+  <version>2.6.1</version>
   <classifier>${os.detected.classifier}</classifier>
 </dependency>
 ```
@@ -173,7 +173,7 @@ buildscript {
 apply plugin: "com.google.osdetector"
 
 dependencies {
-  compile 'org.conscrypt:conscrypt-openjdk:2.6.0:' + osdetector.classifier
+  compile 'org.conscrypt:conscrypt-openjdk:2.6.1:' + osdetector.classifier
 }
 ```
 
@@ -191,14 +191,14 @@ To depend on the uber jar, simply use the `conscrypt-openjdk-uber` artifacts.
 <dependency>
   <groupId>org.conscrypt</groupId>
   <artifactId>conscrypt-openjdk-uber</artifactId>
-  <version>2.6.0</version>
+  <version>2.6.1</version>
 </dependency>
 ```
 
 ##### Gradle
 ```gradle
 dependencies {
-  compile 'org.conscrypt:conscrypt-openjdk-uber:2.6.0'
+  compile 'org.conscrypt:conscrypt-openjdk-uber:2.6.1'
 }
 ```
 
@@ -211,7 +211,7 @@ arm64-v8a.
 
 ```gradle
 dependencies {
-  implementation 'org.conscrypt:conscrypt-android:2.6.0'
+  implementation 'org.conscrypt:conscrypt-android:2.6.1'
 }
 ```
 

android-stub/build.gradle

@@ -11,3 +11,10 @@ dependencies {
 
 // Disable the javadoc task.
 tasks.withType(Javadoc).configureEach { enabled = false }
+
+// The stubs are used to validate the build but are not expected to be called.
+// Skip these lints.
+tasks.withType(JavaCompile).configureEach {
+    options.errorprone.disable("unused")
+    options.errorprone.disable("DoNotCallSuggester")
+}

android-stub/src/main/java/com/android/org/conscrypt/OpenSSLSocketImpl.java

@@ -174,14 +174,6 @@ public void setHostname(String hostname) {
         throw new RuntimeException("Stub!");
     }
 
-    public void setChannelIdEnabled(boolean enabled) {
-        throw new RuntimeException("Stub!");
-    }
-
-    public byte[] getChannelId() throws SSLException {
-        throw new RuntimeException("Stub!");
-    }
-
     public void setChannelIdPrivateKey(PrivateKey privateKey) {
         throw new RuntimeException("Stub!");
     }

android/build.gradle

@@ -129,6 +129,7 @@ dependencies {
     androidTestImplementation libs.bouncycastle.apis
     androidTestImplementation libs.bouncycastle.provider
     androidTestImplementation libs.mockito.android
+    androidTestImplementation libs.truth
     androidTestImplementation('androidx.test.espresso:espresso-core:3.1.1', {
         exclude module: 'support-annotations'
         exclude module: 'support-v4'

android/lint.xml

@@ -28,4 +28,10 @@
     <issue id="Assert">
         <ignore path="**/common/src/main/java/org/conscrypt/OpenSSLCipherChaCha20.java" />
     </issue>
+
+    <!-- Workaround for "Unexpected failure during lint analysis". -->
+    <issue id="LintError">
+        <ignore regexp=".*module-info\.class.*"/>
+    </issue>
+
 </lint>

android/src/main/java/org/conscrypt/ConscryptNetworkSecurityPolicy.java

@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2025 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.conscrypt;
+
+import org.conscrypt.metrics.CertificateTransparencyVerificationReason;
+
+/**
+ * A default NetworkSecurityPolicy for unbundled Android.
+ */
+@Internal
+public class ConscryptNetworkSecurityPolicy implements NetworkSecurityPolicy {
+    public static ConscryptNetworkSecurityPolicy getDefault() {
+        return new ConscryptNetworkSecurityPolicy();
+    }
+
+    @Override
+    public boolean isCertificateTransparencyVerificationRequired(String hostname) {
+        return false;
+    }
+
+    @Override
+    public CertificateTransparencyVerificationReason getCertificateTransparencyVerificationReason(
+            String hostname) {
+        return CertificateTransparencyVerificationReason.UNKNOWN;
+    }
+
+    @Override
+    public DomainEncryptionMode getDomainEncryptionMode(String hostname) {
+        return DomainEncryptionMode.UNKNOWN;
+    }
+}

android/src/main/java/org/conscrypt/KitKatPlatformOpenSSLSocketImplAdapter.java

@@ -402,21 +402,6 @@ public void setHostname(String hostname) {
         delegate.setHostname(hostname);
     }
 
-    @Override
-    public void setChannelIdEnabled(boolean enabled) {
-        delegate.setChannelIdEnabled(enabled);
-    }
-
-    @Override
-    public byte[] getChannelId() throws SSLException {
-        return delegate.getChannelId();
-    }
-
-    @Override
-    public void setChannelIdPrivateKey(PrivateKey privateKey) {
-        delegate.setChannelIdPrivateKey(privateKey);
-    }
-
     @Override
     public void setSoWriteTimeout(int writeTimeoutMilliseconds) throws SocketException {
         delegate.setSoWriteTimeout(writeTimeoutMilliseconds);