Revert "TIKA-1997 -- pkcs detection"

This reverts commit ffd488e.

Author: tballison

CHANGES.txt

@@ -1,12 +1,3 @@
-Release 4.0.0 - ???
-
-  NEW FEATURES
-
-   * Content-based detection of ASN.1/DER crypto containers at parse time. An
-     opt-in Pkcs7Detector surfaces the subtype at detect() time,
-     but must be enabled via configuration (TIKA-1997).
-
-
 Release 4.0.0-beta-1 - 6/29/2026
 
   BREAKING CHANGES

docs/modules/ROOT/examples/detector-pkcs7.json

@@ -131,7 +131,6 @@ JSON uses the backslash as an escape character, so path options (e.g. `tesseract
 
 === Other Configuration
 
-* xref:configuration/detectors.adoc[Detectors] — Configuring content (MIME) detection, incl. the opt-in PKCS7/CMS detector
 * xref:configuration/digesters.adoc[Digesters] — Computing cryptographic hashes of documents
 * xref:configuration/encoding-detectors.adoc[Encoding Detectors] — Configuring charset/encoding detection
 

docs/modules/ROOT/pages/configuration/detectors.adoc

@@ -893,15 +893,6 @@
   <mime-type type="application/pkcs7-mime">
     <glob pattern="*.p7m"/>
     <glob pattern="*.p7c"/>
-    <!-- CMS content types in the 1.2.840.113549.1.9.16.1.* arc (compressedData .9, authData .2,
-         authEnvelopedData .23, ...) with the final OID byte masked. timestamped-data (.31) has the
-         same shape but its own higher-priority magic below. The .7 arc (signed/enveloped/...) is
-         matched by the pkcs7-signature block. Pkcs7Parser refines all of these to the smime-type. -->
-    <magic priority="50">
-      <match value="0x30" offset="0">
-        <match value="0x060B2A864886F70D0109100100" mask="0xFFFFFFFFFFFFFFFFFFFFFFFF00" type="string" offset="2:6"/>
-      </match>
-    </magic>
   </mime-type>
 
   <mime-type type="application/pkcs7-signature">
@@ -935,13 +926,8 @@
 
   <mime-type type="application/timestamped-data">
     <glob pattern="*.tsd"/>
-    <!-- CMS ContentInfo whose contentType is id-ct-timestampedData (1.2.840.113549.1.9.16.1.31),
-         matching the full OID across the DER SEQUENCE length forms (short + 1..4-byte long).
-         Higher priority than the masked pkcs7-mime .9.16.1.* magic so this exact OID wins. -->
-    <magic priority="60">
-      <match value="0x30" offset="0">
-        <match value="0x060B2A864886F70D010910011F" type="string" offset="2:6"/>
-      </match>
+    <magic priority="50">
+      <match value="0x3080060B2A864886F7" type="string" offset="0"/>
     </magic>
   </mime-type>
 
@@ -4881,13 +4867,6 @@
   <mime-type type="application/x-pkcs12">
     <glob pattern="*.p12"/>
     <glob pattern="*.pfx"/>
-    <!-- PFX ::= SEQUENCE { version INTEGER (v3), authSafe ContentInfo SEQUENCE, ... }: the
-         INTEGER 3 then a SEQUENCE (02 01 03 30) tells it apart from CMS (OID next) and keys. -->
-    <magic priority="50">
-      <match value="0x30" offset="0">
-        <match value="0x02010330" offset="2:6"/>
-      </match>
-    </magic>
   </mime-type>
   <mime-type type="application/x-pkcs7-certificates">
     <glob pattern="*.p7b"/>

docs/modules/ROOT/pages/configuration/index.adoc

@@ -16,7 +16,6 @@
  */
 package org.apache.tika.config;
 
-import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 
 import java.io.InputStream;
@@ -28,10 +27,6 @@
 import org.junit.jupiter.api.io.TempDir;
 
 import org.apache.tika.config.loader.TikaLoader;
-import org.apache.tika.detect.Detector;
-import org.apache.tika.io.TikaInputStream;
-import org.apache.tika.metadata.Metadata;
-import org.apache.tika.parser.ParseContext;
 import org.apache.tika.parser.Parser;
 
 /**
@@ -99,29 +94,4 @@ public void testTesseractFullConfig() throws Exception {
     public void testFullMigrationExample() throws Exception {
         loadAndValidate("migration-full-example.json");
     }
-
-    /** The detectors.adoc example: enabling the opt-in pkcs-7-detector yields the CMS smime-type. */
-    @Test
-    public void testPkcs7DetectorConfig() throws Exception {
-        Detector detector = loadDetectors("detector-pkcs7.json");
-        assertEquals("application/pkcs7-mime; smime-type=signed-data",
-                detect(detector, "testPKCS7_signed_data_def.p7m"));
-    }
-
-    private Detector loadDetectors(String resourceName) throws Exception {
-        try (InputStream is = getClass().getResourceAsStream(EXAMPLES_DIR + resourceName)) {
-            assertNotNull(is, "Resource not found: " + resourceName);
-            Path configFile = tempDir.resolve("tika-config.json");
-            Files.writeString(configFile, new String(is.readAllBytes(), StandardCharsets.UTF_8),
-                    StandardCharsets.UTF_8);
-            return TikaLoader.load(configFile).loadDetectors();
-        }
-    }
-
-    private String detect(Detector detector, String resource) throws Exception {
-        try (TikaInputStream tis = TikaInputStream.get(
-                getClass().getResourceAsStream("/test-documents/" + resource))) {
-            return detector.detect(tis, new Metadata(), new ParseContext()).toString();
-        }
-    }
 }

tika-core/src/main/resources/org/apache/tika/mime/tika-mimetypes.xml

@@ -1242,9 +1242,10 @@ public void testCertificatesKeys() throws Exception {
         // Parameters only have PEM form, always need data
         assertTypeByData("application/x-x509-dsa-parameters", "testDSAPARAMS.pem");
         assertTypeByData("application/x-x509-ec-parameters", "testECPARAMS.pem");
-        // PKCS12 is now identified by content via the PFX version-3 anchor (TIKA-1997/TIKA-3784)
-        assertType("application/x-pkcs12", "testRSAKEYandCERT.p12");
-        assertTypeByData("application/x-pkcs12", "testRSAKEYandCERT.p12");
+        // PKCS12 wrappers of Certs+Keys cannot currently be identified
+        // Once solved, see TIKA-3784, ought to work for name or data
+        //assertType("application/x-pkcs12", "testRSAKEYandCERT.p12");
+        //assertTypeByData("application/x-pkcs12", "testRSAKEYandCERT.p12"); // pass=tika
         assertTypeByData("application/x-java-keystore", "KeyStore.jks");
     }