remove useless method TrustedCertificates.refresh()
Add better error message when certificate chain verification fails
Update GlobusGSSException to avoid boring messages

Quite often, a GlobusGSSException is used to wrap an existing
Exception where it adds no additional meaning.

The result of this problem is Exception messages with many chained
"Failure unspecified at GSS-API level" messages.

In addition, SSLEngine suffers from the same problem, throwing an
SSLException with a message that has no meaning and with a Throwable
(that cause the SSLException) containing the meaningful message.

As a work-around, this patch skips over these semantically-null
Exception messages.

This is really a work-around, but fixing the underlying problems will
take sufficiently long that such a work-around is necessary.
Merge pull request #74 from kofemann/bugfixes

remove useless method TrustedCertificates.refresh()
Merge pull request #82 from paulmillar/better-error-msg

Add better error message when certificate chain verification fails
Make GlobusGSSCredentialImpl honour its Serializable identifier.

In JGlobus v1.8, GlobusGSSCredentialImpl was Serializable.  This
feature is relied upon in application that use JGlobus.

Currently, the GlobusGSSCredentialImpl is marked Serializable, but
contains a field, X509Credential, that is not serialisable.  This then
breaks the Serializable contract and attempts to serialise the object
will fail.

X509Credential is not currently Serializable, but contains only one
field member that prevents this: OpenSSLKey.  Therefore, the
critical part of this patch makes the abstract OpenSSLKey
Serializable.

Note that the abstract class OpenSSLKey is a holder for the private
key of a credential and allows certain operations on it.  Only the
IvParameterSpec field member prevents OpenSSLKey from being
Serializable.  The patch records the byte-array used to build
the IvParameterSpec independently of the IvParameterSpec field
member and marks the latter transient.  When deserialising,
the IvParameterSpec field member is rebuilt if the byte-array
is not null.

A number of unit-tests are included to verify that, for both
OpenSSLKey and GlobusGSSCredentialImpl, an object is equal to a
serialised-then-deserialised version of that object.  For this to
work, missing equals methods were implemented and an existing equals
method was fixed.  Unit-tests are also added for these equals
methods.

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Merge pull request #79 from ellert/master

Remove test classes from installed jar, remove code duplication and some other minor fixes
ssl-proxies: Improve RFC 3820 compliance of key usage check

Each certificate in a certificate chain can have a key usage field.
The existing JGlobus code checks that each proxy certificate does not
have more key usages than the issuing certificate. This seems like
a sensible check, however it conflicts with the algorithm described
in RFC 3820.

The RFC states that all key usage (and extended key usage) extensions
of all proxy certificates and the EEC must be collected in a list and
the effective key usage computed by the intersection of all extensions:

   *  If a certificate is a proxy certificate with a policy other than
      id-ppl-independent, the effective key usage and extended key usage
      functionality of the proxy certificate is the intersection of the
      functionality of those extensions in the proxy certificate and the
      effective key usage functionality of the proxy issuer.

We have observed real-world proxy certificates that failed with the
existing check in JGlobus 2, even though they are valid proxies
according to the RFC. These proxies also work with JGlobus 1.
ssl-proxies: Introduce Enum for key usage fields

An Enum allows us to use an EnumSet which internally is
implemented as a bitvector. That is more efficient and
more convenient than using a boolean array.
Merge pull request #89 from gbehrmann/fix/keyusage

Improve RFC 3820 compliance of key usage check
ssl-proxies: Add information about chain to CertPathValidationException

CertPathValidationException has fields to capture the CertPath and
certificate index that triggered the validation failure. This allows
an application to provide more information about the failure to the
user. Yet, JGlobus didn't fill in these fields of the exception,
meaning that the user would not be offered any information beyond
a simple error message saying that the certificate was rejected.

This patch adds the missing information. An application still has to
detect the exception in the exception cause chain and present it to
the user in some form.
Fix GlobusGSSContextTest

The GlobusGSSContextTest relies on having a credential, which then relies
on X509Credential class not having a cached copy of such a credential.
However, it does not ensure there is no such cached credential.

Since multiple tests (and test-suites) are run within the same JVM
instance, the effect is that, if another test-suite caches a
(deliberately) invalid, self-signed certificate then this cached
copy is returned instead of the expected certificate.

This patch fixes this problem by ensuring the cache is cleared.  It
introduces a (negliable) overhead as the cache is flushed between
tests; however, the additional robustness justifies this cost.

Signed-off-by: Tigran Mkrtchyan <tigran.mkrtchyan@desy.de>
Make trustmanager reload CRLs by default.  Fixes #80.

Conflicts:

	ssl-proxies/src/main/java/org/globus/gsi/CertificateRevocationLists.java
	ssl-proxies/src/main/java/org/globus/gsi/trustmanager/X509ProxyCertPathValidator.java
Fix error message and list implementation, as suggested by code review.
ssl-proxies: Fix path validator when cert is lacking key usage extensions

270e41c6b59f5f113edd18cbad71956444f2090c introduced an enum to represent
key usage bits. The patch broke the key usage change for non-proxy certs
in that it did not deal correctly with the absence of the extension.
Merge pull request #92 from gbehrmann/fix/missing_key_usage_extension

ssl-proxies: Fix path validator when cert is lacking key usage extensions
ssl-proxies: Fix several race conditions

In particular the race in CertificateIOUtil has caused signing policies
be registered with the wrong hash. This in turn causes certificates
from the corresponding CA to be rejected.
Merge pull request #93 from gbehrmann/fix/races-signing-policy

ssl-proxies: Fix several race conditions
Try newer version of maven release to see if it clears up the git issues.
Include sonatype fixes from 2.0.5.