title: BouncyCastle version conflict, vendors not cooperating
body: <p>I am currently stuck in integrating Java packages because of a version conflict with BouncyCastle.</p>
  <p>We have internally developed a component to handle data files sent to our local Revenue Service (not &quot;the&quot; IRS, but an equivalent tax authority in another European country) using official Java APIs provided and maintained by them. Another module of our platform uses a component from a Certification Authority to perform certified timestamping of files. Both have to be integrated into a single web application deployed at customer sites.</p>
  <p>As you may know, BouncyCastle packages, on which both packages depend, have undergone several public API changes, so that consequent versions are no more binary compatible.</p>
  <p>Revenue Service provides &quot;cryptotools.jar&quot; package which depends on the following:</p>
  <pre><code>&lt;dependency org=&quot;org.bouncycastle&quot; name=&quot;bcprov-jdk15on&quot; rev=&quot;1.49&quot;/&gt;
  &lt;dependency org=&quot;org.bouncycastle&quot; name=&quot;bcpkix-jdk15on&quot; rev=&quot;1.49&quot;/&gt;
  </code></pre>
  <p>Certification Authority's provides &quot;jades-kernel&quot; timestamping package which depends on</p>
  <pre><code>&lt;dependency org=&quot;org.bouncycastle&quot; name=&quot;bcmail-jdk15&quot;     rev=&quot;1.45&quot;/&gt;
  &lt;dependency org=&quot;org.bouncycastle&quot; name=&quot;bcprov-jdk15&quot;     rev=&quot;1.45&quot;/&gt;
  &lt;dependency org=&quot;org.bouncycastle&quot; name=&quot;bcprov-ext-jdk15&quot; rev=&quot;1.45&quot;/&gt;
  &lt;dependency org=&quot;org.bouncycastle&quot; name=&quot;bctsp-jdk15&quot;      rev=&quot;1.45&quot;/&gt;
  </code></pre>
  <p>Having both packages on classpath results in all BouncyCastle packages to be dumped into my <code>WEB-INF/lib</code> folder, which normally doesn't sound bad</p>
  <p><img src="https://i.stack.imgur.com/r5X9m.png" alt="Dependencies" /></p>
  <p>But if I try to start the web application with all of these packages inside I get an <code>Error</code> saying that a class extends a final method. I won't post the stack trace, it's irrelevant for my question</p>
  <p>If I remove any of the two versions (1.45 or 1.49) of BC, one of the modules won't compile. Well, they are both already compiled, so they won't simply <em>link</em> to their referenced classes/methods.</p>
  <p>I have reported this situation to the CA (with which we have a maintenance contract for the Java APIs), using the older BC version (which has security vulnerabilities found by Black Duck, so that my customer is making my life painful). The CA is not cooperating yet. They would need to release a new version of their cryptography APIs compatible with more recent versions of BouncyCastle.</p>
  <p>Me and my boss (C-level boss) are escalating the issue to CA hierarchy, and, according to our local humour, soon we will be escalating up to <a href="https://en.wikipedia.org/wiki/Pope_Francis" rel="nofollow noreferrer">Francis</a></p>
  <p>Mentioning humour, please allow me to share my current feeling in a visual fashion</p>
  <p><img src="https://i.stack.imgur.com/cODYs.jpg" alt="Dependency hell in Java" /></p>
  <h2>Question time, now back to serious discussion</h2>
  <p>Suppose our vendor does not cooperate, or at least not timely for our regulatory deadlines. Revenue Service will not obviously downgrade their Java APIs to an older BC version.</p>
  <p><strong>How do we get out of this dependency hell?</strong> I know, for example, that log4j had a &quot;bridge&quot; package to mitigate breaking API changes between 1.x and 2.x versions for those packages who haven't upgraded yet. How do we make two modules coexist when they depend on different BC versions?</p>
  <p>I will post a possible workaround but it's not our preferred solution.</p>