[Update 11 Feature] Add support for PGP encryption/decryption with streams

.github/workflows/build-timestamped-master.yml

@@ -12,5 +12,5 @@ jobs:
   call_workflow:
     name: Run Build Workflow
     if: ${{ github.repository_owner == 'ballerina-platform' }}
-    uses: ballerina-platform/ballerina-library/.github/workflows/build-timestamp-master-template.yml@main
+    uses: ballerina-platform/ballerina-library/.github/workflows/build-timestamp-master-template.yml@java21
     secrets: inherit

.github/workflows/build-with-bal-test-graalvm.yml

@@ -30,7 +30,7 @@ jobs:
     call_stdlib_workflow:
         name: Run StdLib Workflow
         if: ${{ github.event_name != 'schedule' || (github.event_name == 'schedule' && github.repository_owner == 'ballerina-platform') }}
-        uses: ballerina-platform/ballerina-library/.github/workflows/build-with-bal-test-graalvm-template.yml@main
+        uses: ballerina-platform/ballerina-library/.github/workflows/build-with-bal-test-graalvm-template.yml@java21
         with:
             lang_tag: ${{ inputs.lang_tag }}
             lang_version: ${{ inputs.lang_version }}

.github/workflows/central-publish.yml

@@ -15,7 +15,7 @@ jobs:
   call_workflow:
     name: Run Central Publish Workflow
     if: ${{ github.repository_owner == 'ballerina-platform' }}
-    uses: ballerina-platform/ballerina-library/.github/workflows/central-publish-template.yml@main
+    uses: ballerina-platform/ballerina-library/.github/workflows/central-publish-template.yml@java21
     secrets: inherit
     with:
       environment: ${{ github.event.inputs.environment }}

.github/workflows/publish-release.yml

@@ -9,7 +9,7 @@ jobs:
   call_workflow:
     name: Run Release Workflow
     if: ${{ github.repository_owner == 'ballerina-platform' }}
-    uses: ballerina-platform/ballerina-library/.github/workflows/release-package-template.yml@main
+    uses: ballerina-platform/ballerina-library/.github/workflows/release-package-template.yml@java21
     secrets: inherit
     with:
       package-name: crypto

.github/workflows/pull-request.yml

@@ -10,5 +10,5 @@ jobs:
     call_workflow:
         name: Run PR Build Workflow
         if: ${{ github.repository_owner == 'ballerina-platform' }}
-        uses: ballerina-platform/ballerina-library/.github/workflows/pull-request-build-template.yml@main
+        uses: ballerina-platform/ballerina-library/.github/workflows/pull-request-build-template.yml@java21
         secrets: inherit

.github/workflows/trivy-scan.yml

@@ -9,5 +9,5 @@ jobs:
   call_workflow:
     name: Run Trivy Scan Workflow
     if: ${{ github.repository_owner == 'ballerina-platform' }}
-    uses: ballerina-platform/ballerina-library/.github/workflows/trivy-scan-template.yml@main
+    uses: ballerina-platform/ballerina-library/.github/workflows/trivy-scan-template.yml@java21
     secrets: inherit

README.md

@@ -54,7 +54,7 @@ This repository only contains the source code for the module.
 
 ### Set up the prerequisites
 
-1. Download and install Java SE Development Kit (JDK) version 17 (from one of the following locations).
+1. Download and install Java SE Development Kit (JDK) version 21 (from one of the following locations).
 
    * [Oracle](https://www.oracle.com/java/technologies/downloads/)
 

ballerina/Ballerina.toml

@@ -1,42 +1,42 @@
 [package]
 org = "ballerina"
 name = "crypto"
-version = "2.7.3"
+version = "2.8.0"
 authors = ["Ballerina"]
 keywords = ["security", "hash", "hmac", "sign", "encrypt", "decrypt", "private key", "public key"]
 repository = "https://github.com/ballerina-platform/module-ballerina-crypto"
 icon = "icon.png"
 license = ["Apache-2.0"]
 distribution = "2201.9.0"
 
-[platform.java17]
+[platform.java21]
 graalvmCompatible = true
 
-[[platform.java17.dependency]]
+[[platform.java21.dependency]]
 groupId = "io.ballerina.stdlib"
 artifactId = "crypto-native"
-version = "2.7.3"
-path = "../native/build/libs/crypto-native-2.7.3-SNAPSHOT.jar"
+version = "2.8.0"
+path = "../native/build/libs/crypto-native-2.8.0-SNAPSHOT.jar"
 
-[[platform.java17.dependency]]
+[[platform.java21.dependency]]
 groupId = "org.bouncycastle"
 artifactId = "bcpkix-jdk18on"
 version = "1.78"
 path = "./lib/bcpkix-jdk18on-1.78.jar"
 
-[[platform.java17.dependency]]
+[[platform.java21.dependency]]
 groupId = "org.bouncycastle"
 artifactId = "bcprov-jdk18on"
 version = "1.78"
 path = "./lib/bcprov-jdk18on-1.78.jar"
 
-[[platform.java17.dependency]]
+[[platform.java21.dependency]]
 groupId = "org.bouncycastle"
 artifactId = "bcutil-jdk18on"
 version = "1.78"
 path = "./lib/bcutil-jdk18on-1.78.jar"
 
-[[platform.java17.dependency]]
+[[platform.java21.dependency]]
 groupId = "org.bouncycastle"
 artifactId = "bcpg-jdk18on"
 version = "1.78"

ballerina/Dependencies.toml

@@ -5,13 +5,14 @@
 
 [ballerina]
 dependencies-toml-version = "2"
-distribution-version = "2201.9.0"
+distribution-version = "2201.10.0-20240926-231800-8a5a4343"
 
 [[package]]
 org = "ballerina"
 name = "crypto"
-version = "2.7.3"
+version = "2.8.0"
 dependencies = [
+	{org = "ballerina", name = "io"},
 	{org = "ballerina", name = "jballerina.java"},
 	{org = "ballerina", name = "lang.array"},
 	{org = "ballerina", name = "test"},
@@ -21,6 +22,19 @@ modules = [
 	{org = "ballerina", packageName = "crypto", moduleName = "crypto"}
 ]
 
+[[package]]
+org = "ballerina"
+name = "io"
+version = "1.6.2"
+scope = "testOnly"
+dependencies = [
+	{org = "ballerina", name = "jballerina.java"},
+	{org = "ballerina", name = "lang.value"}
+]
+modules = [
+	{org = "ballerina", packageName = "io", moduleName = "io"}
+]
+
 [[package]]
 org = "ballerina"
 name = "jballerina.java"
@@ -67,6 +81,15 @@ name = "lang.object"
 version = "0.0.0"
 scope = "testOnly"
 
+[[package]]
+org = "ballerina"
+name = "lang.value"
+version = "0.0.0"
+scope = "testOnly"
+dependencies = [
+	{org = "ballerina", name = "jballerina.java"}
+]
+
 [[package]]
 org = "ballerina"
 name = "test"
@@ -84,7 +107,7 @@ modules = [
 [[package]]
 org = "ballerina"
 name = "time"
-version = "2.4.0"
+version = "2.5.1"
 dependencies = [
 	{org = "ballerina", name = "jballerina.java"}
 ]

ballerina/encrypt_decrypt.bal

@@ -111,7 +111,7 @@ public isolated function encryptAesCbc(byte[] input, byte[] key, byte[] iv, AesP
 # + padding - The padding algorithm
 # + return - Encrypted data or else a `crypto:Error` if the key is invalid
 public isolated function encryptAesEcb(byte[] input, byte[] key, AesPadding padding = PKCS5)
-                                       returns byte[]|Error = @java:Method {
+                                        returns byte[]|Error = @java:Method {
     name: "encryptAesEcb",
     'class: "io.ballerina.stdlib.crypto.nativeimpl.Encrypt"
 } external;
@@ -189,7 +189,7 @@ public isolated function decryptRsaEcb(byte[] input, PrivateKey|PublicKey key, R
 # + padding - The padding algorithm
 # + return - Decrypted data or else a `crypto:Error` if the key is invalid
 public isolated function decryptAesCbc(byte[] input, byte[] key, byte[] iv, AesPadding padding = PKCS5)
-                                       returns byte[]|Error = @java:Method {
+                                        returns byte[]|Error = @java:Method {
     name: "decryptAesCbc",
     'class: "io.ballerina.stdlib.crypto.nativeimpl.Decrypt"
 } external;
@@ -260,11 +260,26 @@ public isolated function encryptPgp(byte[] plainText, string publicKey, *Options
     'class: "io.ballerina.stdlib.crypto.nativeimpl.Encrypt"
 } external;
 
+# Returns the PGP-encrypted stream of the content given in the input stream.
+# ```ballerina
+# stream<byte[], error?> inputStream = check io:fileReadBlocksAsStream("input.txt");
+# stream<byte[], crypto:Error?>|crypto:Error encryptedStream = crypto:encryptStreamAsPgp(inputStream, "public_key.asc");
+# ```
+#
+# + inputStream - The content to be encrypted as a stream
+# + publicKey - Path to the public key
+# + options - PGP encryption options
+# + return - Encrypted stream or else a `crypto:Error` if the key is invalid
+public isolated function encryptStreamAsPgp(stream<byte[], error?> inputStream, string publicKey,
+        *Options options) returns stream<byte[], Error?>|Error = @java:Method {
+    'class: "io.ballerina.stdlib.crypto.nativeimpl.Encrypt"
+} external;
+
 # Returns the PGP-decrypted value of the given PGP-encrypted data.
 # ```ballerina
 # byte[] message = "Hello Ballerina!".toBytes();
 # byte[] cipherText = check crypto:encryptPgp(message, "public_key.asc");
-# 
+#
 # byte[] passphrase = check io:fileReadBytes("pass_phrase.txt");
 # byte[] decryptedMessage = check crypto:decryptPgp(cipherText, "private_key.asc", passphrase);
 # ```
@@ -278,3 +293,19 @@ public isolated function decryptPgp(byte[] cipherText, string privateKey, byte[]
     name: "decryptPgp",
     'class: "io.ballerina.stdlib.crypto.nativeimpl.Decrypt"
 } external;
+
+# Returns the PGP-decrypted stream of the content given in the input stream.
+# ```ballerina
+# byte[] passphrase = check io:fileReadBytes("pass_phrase.txt");
+# stream<byte[], error?> inputStream = check io:fileReadBlocksAsStream("pgb_encrypted.txt");
+# stream<byte[], crypto:Error?>|crypto:Error decryptedStream = crypto:decryptStreamFromPgp(inputStream, "private_key.asc", passphrase);
+# ```
+#
+# + inputStream - The encrypted content as a stream
+# + privateKey - Path to the private key
+# + passphrase - passphrase of the private key
+# + return - Decrypted stream or else a `crypto:Error` if the key or passphrase is invalid
+public isolated function decryptStreamFromPgp(stream<byte[], error?> inputStream, string privateKey,
+        byte[] passphrase) returns stream<byte[], Error?>|Error = @java:Method {
+    'class: "io.ballerina.stdlib.crypto.nativeimpl.Decrypt"
+} external;

ballerina/private_public_key.bal

@@ -176,7 +176,7 @@ public isolated function decodeRsaPrivateKeyFromKeyFile(string keyFile, string?
 # crypto:PrivateKey privateKey = check crypto:decodeRsaPrivateKeyFromContent(keyFileContent, "keyPassword");
 # ```
 #
-# + keyFile - Private key content as a byte array
+# + content - Private key content as a byte array
 # + keyPassword - Password of the private key if it is encrypted
 # + return - Reference to the private key or else a `crypto:Error` if the private key was unreadable
 public isolated function decodeRsaPrivateKeyFromContent(byte[] content, string? keyPassword = ()) returns PrivateKey|Error = @java:Method {
@@ -311,7 +311,7 @@ public isolated function decodeRsaPublicKeyFromCertFile(string certFile) returns
 # crypto:PublicKey publicKey = check crypto:decodeRsaPublicKeyFromContent(certContent);
 # ```
 #
-# + certFile - The certificate content as a byte array
+# + content - The certificate content as a byte array
 # + return - Reference to the public key or else a `crypto:Error` if the public key was unreadable
 public isolated function decodeRsaPublicKeyFromContent(byte[] content) returns PublicKey|Error = @java:Method {
     'class: "io.ballerina.stdlib.crypto.nativeimpl.Decode"

ballerina/stream_iterators.bal

@@ -0,0 +1,81 @@
+// Copyright (c) 2024 WSO2 LLC. (https://www.wso2.com).
+//
+// WSO2 LLC. licenses this file to you under the Apache License,
+// Version 2.0 (the "License"); you may not use this file except
+// in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import ballerina/jballerina.java;
+
+class DecryptedStreamIterator {
+    boolean isClosed = false;
+
+    public isolated function next() returns record {|byte[] value;|}|Error? {
+        byte[]|Error? bytes = self.readDecryptedStream();
+        if bytes is byte[] {
+            return {value: bytes};
+        } else {
+            return bytes;
+        }
+    }
+
+    public isolated function close() returns Error? {
+        if !self.isClosed {
+            var closeResult = self.closeDecryptedStream();
+            if closeResult is () {
+                self.isClosed = true;
+            }
+            return closeResult;
+        }
+        return;
+    }
+
+    isolated function readDecryptedStream() returns byte[]|Error? = @java:Method {
+        'class: "io.ballerina.stdlib.crypto.nativeimpl.StreamUtils"
+    } external;
+
+    isolated function closeDecryptedStream() returns Error? = @java:Method {
+        'class: "io.ballerina.stdlib.crypto.nativeimpl.StreamUtils"
+    } external;
+}
+
+class EncryptedStreamIterator {
+    boolean isClosed = false;
+
+    public isolated function next() returns record {|byte[] value;|}|Error? {
+        byte[]|Error? bytes = self.readEncryptedStream();
+        if bytes is byte[] {
+            return {value: bytes};
+        } else {
+            return bytes;
+        }
+    }
+
+    public isolated function close() returns Error? {
+        if !self.isClosed {
+            var closeResult = self.closeEncryptedStream();
+            if closeResult is () {
+                self.isClosed = true;
+            }
+            return closeResult;
+        }
+        return;
+    }
+
+    isolated function readEncryptedStream() returns byte[]|Error? = @java:Method {
+        'class: "io.ballerina.stdlib.crypto.nativeimpl.StreamUtils"
+    } external;
+
+    isolated function closeEncryptedStream() returns Error? = @java:Method {
+        'class: "io.ballerina.stdlib.crypto.nativeimpl.StreamUtils"
+    } external;
+}