From 42af0de16f81213f2d39c6f87feb9235000f972d Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Tue, 13 Oct 2026 13:17:25 +0300
Subject: [PATCH 1/2] Use commons 3.2.2-SNAPSHOT to pick up BouncyCastle 1.86

commons 3.2.2-SNAPSHOT manages bc-jdk18on-bom 1.86 (commons PR #326),
which fixes CVE-2026-8763 and CVE-2026-13506 in bcprov-jdk18on 1.84.
OpenDJ itself uses only the FIPS artifacts, already at bc-fips 2.1.3;
the bump reaches OpenICF, which imports opendj-parent as its BOM.
---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index 793b638621..87b326c266 100644
--- a/pom.xml
+++ b/pom.xml
@@ -35,7 +35,7 @@
         <product.locales>ca_ES,es,de,fr,ja,ko,pl,zh_CN,zh_TW</product.locales>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <localized.jars.classifier>i18n</localized.jars.classifier>
-        <commons.version>3.2.1</commons.version>
+        <commons.version>3.2.2-SNAPSHOT</commons.version>
         <freemarker.version>2.3.35</freemarker.version>
         <metrics-core.version>4.2.30</metrics-core.version>
         <bc.fips.version>2.1.3</bc.fips.version>

From 9b93501660efa15b35976b86978b2102a7099b7b Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Wed, 14 Oct 2026 10:28:30 +0300
Subject: [PATCH 2/2] Wait for the background join to end before looking for
 the root password it leaves

The pre-roles srs phase (#1184) recreates dj-1 on a volume that reports itself
healthy at once, and the password check right after it found the join's
/dev/shm password file while join.sh was still in joined(). Wait until no
bootstrap script runs in the container before checking.
---
 .github/scripts/docker-test-replication.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/scripts/docker-test-replication.sh b/.github/scripts/docker-test-replication.sh
index ca838be3e1..9070639908 100755
--- a/.github/scripts/docker-test-replication.sh
+++ b/.github/scripts/docker-test-replication.sh
@@ -175,6 +175,14 @@ recorded_role_of() { # <container>
   docker exec "$1" cat /opt/opendj/data/.replication-role 2>/dev/null
 }
 
+# no join.sh or replicate.sh runs in the container any more. A volume that holds the data
+# reports itself healthy from the start while its join still runs, and the join keeps its
+# password file until it ends. The bracket keeps the pattern from matching the command line
+# of the sh that greps for it
+bootstrap_ended() { # <container>
+  ! docker exec "$1" sh -c "grep -qs -e 'bootstrap/[j]oin\.sh' -e 'bootstrap/[r]eplicate\.sh' /proc/[0-9]*/cmdline"
+}
+
 # the writability-mode the backend of dc=example,dc=com is configured with, empty where its
 # entry sets none
 backend_mode() { # <container>
@@ -770,6 +778,7 @@ wait_healthy dj-1
 
 # the root password shows in no container log, and the files the tools read it from are gone
 for c in dj-0 dj-1 dj-2 dj-sdsr; do
+  wait_until 300 "the bootstrap scripts of $c end" bootstrap_ended $c
   if docker logs $c 2>&1 | grep -F -- "$ROOT_PASSWORD"; then fail "the root password is in the log of $c"; fi
   left=$(docker exec $c grep -rlsF -- "$ROOT_PASSWORD" /tmp /dev/shm || true)
   [ -z "$left" ] || fail "the root password is left in $left of $c"