v7.0.0: Complete rewrite as drop-in replacement

[joewiz]

Summary

Complete rewrite of the EXPath Cryptographic Module for eXist-db 7.0+. Zero external dependencies — uses only Java's built-in JCE.

• Drop-in replacement: same package URI (http://expath.org/ns/crypto), same module namespace, same function names, all v6 arities preserved
• 102 tests: 64 JUnit + 38 XQSuite, including vectors adapted from the old test suite and BaseX cross-compatibility tests
• BaseX compatible: function signatures match BaseX's crypto module for cross-engine portability

Spec sources

This implementation targets conformance with four sources:

1. EXPath Cryptographic Module 1.0 (2010) — the original spec
2. EXPath Cryptographic Module Editor's Draft (2017) — map-based parameter consolidation
3. EXPath Crypto 2018 CG Final Report by Claudius Teodorescu — adds `list-providers`/`list-services`/`list-algorithms`, Java-style algorithm names (`DSAwithSHA1`), XML Canonicalization 1.1, and map-based `generate-signature`
4. BaseX Cryptographic Functions — cross-engine compatibility

Each function class documents which spec sources it conforms to in its Javadoc.

What's new

• Binary input for `crypto:hmac` (xs:base64Binary, xs:hexBinary)
• All 4 `generate-signature` positional arities: 6-param, 7-param (xpath), 8-param (certificate), 3-param (private key)
• 2-param map-based `generate-signature` per 2018 CG spec / editor's draft
• Algorithm name aliases: `DSAwithSHA1`/`RSAwithSHA1` (2018 CG spec)
• Canonicalization 1.1: `inclusive-1.1`, `inclusive-with-comments-1.1` (2018 CG spec)
• 6-param `encrypt`/`decrypt` for backward compatibility (iv + provider)
• RSA_SHA256 signature algorithm
• AES-192 and AES-256 key sizes
• `list-providers`/`list-services`/`list-algorithms` implemented (2018 CG spec) but disabled pending eXist binary search fix for zero-param arities
• CI: Java 21 on 3 OSes, dependabot for Maven + Actions

Breaking changes from v6

1. `crypto:encrypt` output format: v6 returned dash-separated bytes (`"51-143-171-..."`); v7 returns `xs:base64Binary`. Stored ciphertext from v6 must be re-encrypted.
2. DSA_SHA1 forbidden: Java 17+ secure validation rejects DSA_SHA1. Use RSA_SHA256 instead.

Test plan

• All 102 tests pass (101 + 1 pending for enveloping signature investigation)
• Old module's exact hash/HMAC expected values verified
• BaseX HMAC test vectors verified (md5/sha1/sha256/sha384/sha512, base64+hex)
• AWS S3 REST authentication pattern verified (corrected old test's expected value via Python hmac)
• 6-param encrypt/decrypt round-trip verified
• 7-param generate-signature with XPath verified
• Tested autodeploy on fresh eXist-db 7.0 Docker container — zero errors, JWT dependency resolves correctly
• CI green on ubuntu, macos, windows (Java 21)

[This response was co-authored with Claude Code. -Joe]

🤖 Generated with Claude Code

[joewiz]

[This response was co-authored with Claude Code. -Joe]

Thanks for the thorough review, @reinhapa! All addressed in 4b73123:

• Version: CryptoModule.RELEASE updated from "1.0.0" to "7.0.0"
• Text blocks: Converted all multi-line string concatenations in function descriptions and param descriptions to Java 15 text blocks (7 source files + test file)
• Switch expression: CryptoUtils.validateAlgorithmAndKey() now uses arrow-style switch
• Error message strings in throw statements left as concatenations (they reference local variables)

All 102 tests pass.