Amazefilemanager: For more security spongycastle -> bouncycastle

[Neustradamus]

For more security, can you change old spongycastle (based on old bouncycastle) to bouncycastle?

• https://www.bouncycastle.org/
• https://www.bouncycastle.org/releasenotes.html
• http://www.bouncycastle.org/latest_releases.html
• https://www.cvedetails.com/vulnerability-list/vendor_id-7637/Bouncycastle.html

[TranceLove]

Hmmm... this is a hard one.

We chose to use spongycastle since we need to use updated BouncyCastle for updated crypto code not available from stock BouncyCastle, which versions differ with different Android versions.

Happy to know if there is a way to use updated BouncyCastle without letting Android apps ignore the version we want to use, but always fall back to Android's own BouncyCastle.

[Neustradamus]

@TranceLove: Thanks for your comment!
Currently Bouncy Castle last version is 1.65 and Spongy Castle last version is 1.58.
Spongy Castle is a fork of Bouncy Castle.
Please look previous links :)

Since several years, a lot of projects have already moved from Spongy Castle to Bouncy Castle because the project is dead.

You can see discussion "34" in https://github.com/rtyley/spongycastle/issues.

[TranceLove]

Thanks @Neustradamus, @rtyley/spongycastle#34 and a quick Google/StackOverflow both pointed to a node.js module to help building bouncycastle at their own namespace: @jbuhacoff/nodejs-mybc-util

Let's see when I have time to make our own bouncycastle jars.

[Neustradamus]

@TranceLove: nodejs-mybc-util is optional because a lot of projects have been migrated without...

[Neustradamus]

@TranceLove: Not possible to add directly in gradle?

[TranceLove]

@TranceLove: Not possible to add directly in gradle?

Sorry for overlooking - that the discussion mentioned above actually pointed out that there is no namespace collision since Android 3.0.

I then tried a bit, seems promising. But is getting Espresso test failures on Kitkat - seems not directly related to migration to BouncyCastle though coding problem actually, otherwise is fine.

Will retract #1874 after tests passed using changeset from #1831.

[VishalNehra]

Great, thanks for looking into this @TranceLove

[Neustradamus]

@TranceLove, @VishalNehra, @bowiechen: Thanks a lot!
But not complete: https://github.com/TeamAmaze/AmazeFileManager/search?q=spongycastle&unscoped_q=spongycastle