Skip to content

Request: migrate away from SpongyCastle 1.58 to bcprov-jdk15to18 #6

Description

@opsalis

Summary

The Tangem Android SDK still depends on SpongyCastle 1.58.0.0 (com.madgag.spongycastle:core / :prov), which is transitively pulled into every consuming app. SpongyCastle has been deprecated/abandoned for years (1.58 dates to 2017). We'd like to request migrating the SDK off it.

Why this matters

  • SpongyCastle existed only as a workaround for an old Android issue: the platform ships a stripped-down org.bouncycastle provider, which used to make the upstream BouncyCastle jar unusable on Android. Modern BouncyCastle now ships an official Android-optimized variant, org.bouncycastle:bcprov-jdk15to18, which resolves exactly that classloader/package-collision problem. So the original reason for SpongyCastle no longer exists.
  • SpongyCastle 1.58 no longer receives security updates, so consumers inherit an abandoned crypto library on the classpath of a hardware-wallet SDK.

Why simple exclusion doesn't work (for other consumers hitting this)

The SDK's core bytecode references org.spongycastle.* directly on card-crypto paths — e.g. the secp256k1 curve parameters, the ECDSA signer, and org.spongycastle.jce.provider.BouncyCastleProvider. Excluding the dependency therefore throws NoClassDefFoundError: org.spongycastle.* at runtime on a real card tap; it can't be dropped without an SDK-side migration.

Request

Migrate the SDK's crypto references from org.spongycastle.* to the maintained org.bouncycastle:bcprov-jdk15to18 (org.bouncycastle.*), eliminating the last dependency on the abandoned library. Happy to help test against the migrated build.

Thanks!

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions