How to include the Spongy Castle JAR in Android?

Apparently Spongy Castle is the Android alternative to using a full version of Bouncy Castle.

However, on importing the jar I'm getting all kinds of "cannot be resolved" errors because it relies on packages not included with Android, primarily javax.mail, javax.activation, and javax.awt.datatransfer.

So what's the best way around this? Responses to this question and this indicate those packages shouldn't be used at all, and this popular question doesn't even consider finding a way to get AWT back. So how is Spongy Castle relying on them? People are using Spongy Cast开发者_运维技巧le, right?

If you are using gradle, then you can just specify your dependencies in build.gradle file like this:

dependencies {
     ....
    compile 'com.madgag.spongycastle:core:1.54.0.0'
    compile 'com.madgag.spongycastle:prov:1.54.0.0'
    compile 'com.madgag.spongycastle:pkix:1.54.0.0'
    compile 'com.madgag.spongycastle:pg:1.54.0.0'

    }

You can find out the latest version of the library here.

Don't forget to insert it as a security provider in your app.

    static {
    Security.insertProviderAt(new org.spongycastle.jce.provider.BouncyCastleProvider(), 1);
}

These are two very simple examples of how to include Spongy Castle in a project:

• github.com/rtyley/spongycastle-eclipse - Eclipse
• github.com/rtyley/toy-android-ssh-agent - Maven

Since v1.47, Spongy Castle has been split into separate sub-jars that exactly mirror the matching Bouncy Castle artifacts (eg sc-light-jdk15on.jar, scpg-jdk15on.jar, etc), and it is important to ensure you include all the Spongy Castle jars required for what you're doing.

Full information on dependencies can be found at:

http://rtyley.github.com/spongycastle/#downloads

At minimum you'll need the sc-light-jdk15on.jar (the base lightweight-API implementation) and probably scprov-jdk15on.jar (the JCE wrapper around the lightweight-API). If you're using Maven then all this dependency-management stuff is taken care of for you.

The problematic dependencies you describe on javax.mail, javax.activation, etc, indicate that you might have chosen an incorrect jar (e.g. the every-single-library-component one, rather than the 'core provider' one) - as the scprov-jdk15on jar definitely doesn't have any of those weird dependencies, and runs happily on Android.

(disclaimer, I'm the maintainer of Spongy Castle, but I've had plenty of success reports from other users too!)

In the meanwhile BouncyCastle can be used directly. In later Android versions the internal BC package name has changed and at least the package name collision is not the problem anymore, but there are still issues. For a solution look at this: https://stackoverflow.com/a/57897224/3351474