From 6c9ac5751d780d5b66c7544152a8c744acee4b38 Mon Sep 17 00:00:00 2001
From: Andreas Wehrmann <andreas.wehrmann@sap.com>
Date: Fri, 4 Sep 2026 10:40:26 +0200
Subject: [PATCH 1/2] revert(crypto): restore standard Bouncy Castle

This reverts commit ad9b06cecbd06581f9b5c0a38cf942bf85fe4ff3 to restore the pre-FIPS provider and dependency configuration.
---
 .../ng/CertificateHttpClientConfig.java       | 14 +++++------
 pom.xml                                       | 25 ++++---------------
 2 files changed, 12 insertions(+), 27 deletions(-)

diff --git a/cds-feature-auditlog-ng/src/main/java/com/sap/cds/feature/auditlog/ng/CertificateHttpClientConfig.java b/cds-feature-auditlog-ng/src/main/java/com/sap/cds/feature/auditlog/ng/CertificateHttpClientConfig.java
index c73a5d9..c45e656 100644
--- a/cds-feature-auditlog-ng/src/main/java/com/sap/cds/feature/auditlog/ng/CertificateHttpClientConfig.java
+++ b/cds-feature-auditlog-ng/src/main/java/com/sap/cds/feature/auditlog/ng/CertificateHttpClientConfig.java
@@ -24,7 +24,7 @@
 import org.apache.http.impl.client.HttpClients;
 import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
 import org.bouncycastle.cert.X509CertificateHolder;
-import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;
+import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.openssl.PEMParser;
 import org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder;
 import org.bouncycastle.operator.InputDecryptorProvider;
@@ -52,9 +52,9 @@ public class CertificateHttpClientConfig {
     private static final Logger logger = LoggerFactory.getLogger(CertificateHttpClientConfig.class);
 
     static {
-        // Register BouncyCastle FIPS provider if not already present
-        if (Security.getProvider("BCFIPS") == null) {
-            Security.addProvider(new BouncyCastleFipsProvider());
+        // Register BouncyCastle provider if not already present
+        if (Security.getProvider("BC") == null) {
+            Security.addProvider(new BouncyCastleProvider());
         }
     }
 
@@ -170,11 +170,11 @@ public CertificateHttpClientConfig build() {
     private CloseableHttpClient createHttpClient() {
         try {
             char[] effectivePassphrase = (keyPassphrase != null) ? keyPassphrase.toCharArray() : new char[0];
-            logger.info("Creating HttpClient with certificate authentication and {} retries (BCFIPS)", maxRetries);
+            logger.info("Creating HttpClient with certificate authentication and {} retries", maxRetries);
             X509Certificate[] certChain = parseCertificateChain(certPem);
             PrivateKey privateKey = parsePrivateKey(keyPem, effectivePassphrase);
 
-            KeyStore keyStore = KeyStore.getInstance("PKCS12", "BCFIPS");
+            KeyStore keyStore = KeyStore.getInstance("PKCS12");
             keyStore.load(null, null);
             keyStore.setKeyEntry("client", privateKey, new char[0], certChain);
 
@@ -237,7 +237,7 @@ private static PrivateKey parsePrivateKey(String keyPem, char[] passphrase) thro
                 return KeyFactory.getInstance("RSA").generatePrivate(keySpec);
             } else if (object instanceof PKCS8EncryptedPrivateKeyInfo encInfo) {
                 try {
-                    InputDecryptorProvider decryptorProvider = new JceOpenSSLPKCS8DecryptorProviderBuilder().setProvider("BCFIPS").build(effectivePassphrase);
+                    InputDecryptorProvider decryptorProvider = new JceOpenSSLPKCS8DecryptorProviderBuilder().build(effectivePassphrase);
                     PrivateKeyInfo keyInfo = encInfo.decryptPrivateKeyInfo(decryptorProvider);
                     PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(keyInfo.getEncoded());
                     return KeyFactory.getInstance("RSA").generatePrivate(keySpec);
diff --git a/pom.xml b/pom.xml
index 8e9b28d..bcaf0bf 100644
--- a/pom.xml
+++ b/pom.xml
@@ -38,10 +38,7 @@
     <mockito.version>5.18.0</mockito.version>
     <sdk-bom.version>5.25.0</sdk-bom.version>
     <mockito-bom.version>5.21.0</mockito-bom.version>
-    <bc-fips.version>2.1.3</bc-fips.version>
-    <bcpkix-fips.version>2.1.8</bcpkix-fips.version>
-    <bctls-fips.version>2.1.20</bctls-fips.version>
-    <bcutil-fips.version>2.1.5</bcutil-fips.version>
+    <bcpkix-jdk18on.version>1.83</bcpkix-jdk18on.version>
   </properties>
 
   <groupId>com.sap.cds</groupId>
@@ -89,26 +86,14 @@
   <dependencies>
     <dependency>
       <groupId>org.bouncycastle</groupId>
-      <artifactId>bc-fips</artifactId>
-      <version>${bc-fips.version}</version>
+      <artifactId>bcprov-jdk18on</artifactId>
+      <version>${bcpkix-jdk18on.version}</version>
     </dependency>
 
     <dependency>
       <groupId>org.bouncycastle</groupId>
-      <artifactId>bcpkix-fips</artifactId>
-      <version>${bcpkix-fips.version}</version>
-    </dependency>
-
-    <dependency>
-      <groupId>org.bouncycastle</groupId>
-      <artifactId>bctls-fips</artifactId>
-      <version>${bctls-fips.version}</version>
-    </dependency>
-
-    <dependency>
-      <groupId>org.bouncycastle</groupId>
-      <artifactId>bcutil-fips</artifactId>
-      <version>${bcutil-fips.version}</version>
+      <artifactId>bcpkix-jdk18on</artifactId>
+      <version>${bcpkix-jdk18on.version}</version>
     </dependency>
 
     <dependency>

From a6ee3c2f021110a1a1424fb93d1cc085cfe98d3f Mon Sep 17 00:00:00 2001
From: Andreas Wehrmann <andreas.wehrmann@sap.com>
Date: Fri, 4 Sep 2026 10:49:14 +0200
Subject: [PATCH 2/2] chore: bump version to 0.1.1

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index bcaf0bf..6661c92 100644
--- a/pom.xml
+++ b/pom.xml
@@ -24,7 +24,7 @@
   </developers>
 
   <properties>
-    <revision>0.1.0</revision>
+    <revision>0.1.1</revision>
     <java.version>17</java.version>
     <maven.compiler.release>${java.version}</maven.compiler.release>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>