Dependency Conflict: Incompatible Bouncy Castle Artifacts (bcprov-jdk15on:1.65 vs. bcprov-jdk15to18:1.77) Causing Duplicate Classes Issue

[moumitaDas15]

I am sharing the scenario below which is causing an issue after adding an SDK dependency:

I am facing a duplicate classes issue for Bouncy Castle (snapshot of the issue given below):

Duplicate class org.bouncycastle.x509.util.LDAPStoreHelper found in modules bcprov-jdk15on-1.65.jar -> bcprov-jdk15on-1.65 (org.bouncycastle:bcprov-jdk15on:1.65) and bcprov-jdk15to18-1.77.jar -> bcprov-jdk15to18-1.77 (org.bouncycastle:bcprov-jdk15to18:1.77)
Duplicate class org.bouncycastle.x509.util.StreamParser found in modules bcprov-jdk15on-1.65.jar -> bcprov-jdk15on-1.65 (org.bouncycastle:bcprov-jdk15on:1.65) and bcprov-jdk15to18-1.77.jar -> bcprov-jdk15to18-1.77 (org.bouncycastle:bcprov-jdk15to18:1.77)
Duplicate class org.bouncycastle.x509.util.StreamParsingException found in modules bcprov-jdk15on-1.65.jar -> bcprov-jdk15on-1.65 (org.bouncycastle:bcprov-jdk15on:1.65) and bcprov-jdk15to18-1.77.jar -> bcprov-jdk15to18-1.77 (org.bouncycastle:bcprov-jdk15to18:1.77)

Duplicate Classes Found in:

bcprov-jdk15on-1.65.jar (org.bouncycastle:bcprov-jdk15on:1.65)
bcprov-jdk15to18-1.77.jar (org.bouncycastle:bcprov-jdk15to18:1.77)

Duplicate Classes:

org.bouncycastle.x509.util.LDAPStoreHelper
org.bouncycastle.x509.util.StreamParser
org.bouncycastle.x509.util.StreamParsingException

On running the ./gradlew app:dependencies command, I found that Bouncy Castle is included by two different SDKs :
(by the new SDK which I am adding, and a SDK which already exists in our project)

 +--- another SDK 
|    |    |    +--- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.21 -> 2.0.21 (*)
|    |    |    +--- org.bouncycastle:bcpkix-jdk15on:1.65
|    |    |    |    \--- org.bouncycastle:bcprov-jdk15on:1.65
|    |    |    +--- org.bouncycastle:bcprov-jdk15on:1.65

--- new SDK
|    |    |    +--- org.slf4j:slf4j-api:1.7.36
|    |    |    +--- org.bouncycastle:bcprov-jdk15to18:1.77

bcprov-jdk15on:1.65 → included by that one SDK which already exists in our project.
bcprov-jdk15to18:1.77 → included by the SDK which I newly adding.

Shared dependencies are common, and Gradle usually resolves them by selecting the latest version. However, in this case, the issue likely arises due to **incompatible Bouncy Castle artifacts rather than just a version conflict**.

bcprov-jdk15on:1.65 and bcprov-jdk15to18:1.77 are different artifacts, not just different versions.
Some libraries expect bcprov-jdk15on, while others expect bcprov-jdk15to18.
If Gradle picks bcprov-jdk15to18:1.77, but another library relies on classes that only exist in bcprov-jdk15on, we will get missing class/unresolved reference errors.

We need Bouncy Castle’s team support to understand the best way to resolve this dependency issue.

[dghgit]

Move to bcprov-jdk15to18 1.77. It is quite a jump, what are the missing classes?

[moumitaDas15]

Hey @dghgit ,

Are you suggesting the below solution??

Move to bcprov-jdk15to18 1.77. It is quite a jump, what are the missing classes?

• Remove the older version (bcprov-jdk15on:1.65) from my dependencies.
• Use only bcprov-jdk15to18:1.77 in my project.

[dghgit]

Yes. That's the only way forward.

[moumitaDas15]

Hey @dghgit ,

Along with moving to the bcprov-jdk15to18:1.77, do we also need to move to bcpkix-jdk15to18:1.77 from bcpkix-jdk15on:1.65 ??

Cause as per the dependency chart:

 +--- another SDK 
|    |    |    +--- org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.21 -> 2.0.21 (*)
|    |    |    +--- org.bouncycastle:bcpkix-jdk15on:1.65
|    |    |    |    \--- org.bouncycastle:bcprov-jdk15on:1.65
|    |    |    +--- org.bouncycastle:bcprov-jdk15on:1.65

--- new SDK
|    |    |    +--- org.slf4j:slf4j-api:1.7.36
|    |    |    +--- org.bouncycastle:bcprov-jdk15to18:1.77

[dghgit]

Yes, make sure everything is the same version.