Make classes final to please JDK21

.github/workflows/robot.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        java: [ 8, 11, 17 ] # FIXME: add back 21 once CAPFile is refactored
+        java: [ 8, 11, 17, 21 ]
     name: Java ${{ matrix.java }}
     steps:
       - name: Checkout with submodules

capfile/src/main/java/pro/javacard/capfile/CAPFile.java

@@ -52,7 +52,7 @@
  * Parses a CAP file as specified in JavaCard 2.2 VM Specification, chapter 6.
  * CAP files are tiny, so we keep it in memory.
  */
-public class CAPFile {
+public final class CAPFile {
     public static final String DAP_RSA_V1_SHA1_FILE = "dap.rsa.sha1";
     public static final String DAP_RSA_V1_SHA256_FILE = "dap.rsa.sha256";
     public static final String DAP_P256_SHA1_FILE = "dap.p256.sha1";
@@ -93,8 +93,8 @@ public Optional<Path> getFile() {
         return Optional.ofNullable(file);
     }
 
-    protected byte[] getComponent(String name) {
-        return entries.get(pkg2jcdir(getPackageName()) + name + ".cap");
+    public byte[] getComponent(String name) {
+        return entries.get(pkg2jcdir(getPackageName()) + name + ".cap").clone();
     }
 
     public byte[] getMetaInfEntry(String name) {
@@ -111,34 +111,36 @@ public void store(OutputStream to) throws IOException {
         }
     }
 
-    // FIXME: 21 rightfully complains about this (getComponent leaking this)
+    // XXX: 21 rightfully complains about this without final (getComponent leaking this)
     protected CAPFile(InputStream in) throws IOException {
         try (ZipInputStream zip = new ZipInputStream(in)) {
             // All ZIP entries
             entries = readEntries(zip);
-            // Parse manifest
-            byte[] mf = entries.get("META-INF/MANIFEST.MF");
-            if (mf != null) {
-                ByteArrayInputStream mfi = new ByteArrayInputStream(mf);
-                manifest = new Manifest(mfi);
-            }
+        }
 
-            // Only if there are applets
-            byte[] ai = entries.get("APPLET-INF/applet.xml");
-            if (ai != null) {
-                try {
-                    DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
-                    // Not really a threat (intended for self-generated local files) but still nice to have
-                    dbFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
-                    DocumentBuilder dBuilder = dbFactory.newDocumentBuilder();
-                    appletxml = dBuilder.parse(new ByteArrayInputStream(ai));
-                    appletxml.getDocumentElement().normalize();
-                } catch (SAXException | ParserConfigurationException e) {
-                    throw new IOException(e);
-                }
+        // Parse manifest
+        byte[] mf = entries.get("META-INF/MANIFEST.MF");
+        if (mf != null) {
+            ByteArrayInputStream mfi = new ByteArrayInputStream(mf);
+            manifest = new Manifest(mfi);
+        }
+
+        // Only if there are applets
+        byte[] ai = entries.get("APPLET-INF/applet.xml");
+        if (ai != null) {
+            try {
+                DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
+                // Not really a threat (intended for self-generated local files) but still nice to have
+                dbFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+                DocumentBuilder dBuilder = dbFactory.newDocumentBuilder();
+                appletxml = dBuilder.parse(new ByteArrayInputStream(ai));
+                appletxml.getDocumentElement().normalize();
+            } catch (SAXException | ParserConfigurationException e) {
+                throw new IOException(e);
             }
         }
 
+
         // Figure out package name. Failsafe without metadata as well, for 2.1.X support.
         String pkgname = null;
         for (String p : entries.keySet()) {
@@ -203,7 +205,7 @@ protected CAPFile(InputStream in) throws IOException {
         }
     }
 
-    private Map<String, byte[]> readEntries(ZipInputStream in) throws IOException {
+    private static Map<String, byte[]> readEntries(ZipInputStream in) throws IOException {
         Map<String, byte[]> result = new LinkedHashMap<>();
         ZipEntry entry = in.getNextEntry();
         while (entry != null) {
@@ -216,7 +218,7 @@ private Map<String, byte[]> readEntries(ZipInputStream in) throws IOException {
             result.put(entry.getName(), bos.toByteArray());
             entry = in.getNextEntry();
         }
-        return result;
+        return Collections.unmodifiableMap(result);
     }
 
     public AID getPackageAID() {

capfile/src/main/java/pro/javacard/capfile/CAPPackage.java

@@ -24,7 +24,7 @@
 import java.util.Objects;
 import java.util.Optional;
 
-public class CAPPackage {
+public final class CAPPackage {
     final AID aid;
     final int minor;
     final int major;

capfile/src/main/java/pro/javacard/sdk/OffCardVerifier.java

@@ -34,7 +34,7 @@
 import java.util.jar.JarFile;
 import java.util.stream.Collectors;
 
-public class OffCardVerifier {
+public final class OffCardVerifier {
     private final JavaCardSDK sdk;
 
     public static OffCardVerifier withSDK(JavaCardSDK sdk) {

task/src/main/java/pro/javacard/ant/JavaCard.java

@@ -360,7 +360,7 @@ private void check() {
                     if (target.isOneOf(V304, V305, V310, V320)) {
                         targetsdk = jckit.target(target);
                     } else {
-                        throw new HelpingBuildException("Can not target JavaCard " + targetVersion.get() + " with JavaCard kit " + jckit.getVersion());
+                        throw new HelpingBuildException("Can not target JavaCard " + target + " with JavaCard kit " + jckit.getVersion());
                     }
                 } else {
                     targetsdk = JavaCardSDK.detectSDK(getProject().resolveFile(raw_targetsdk).toPath()).orElseThrow(() -> new HelpingBuildException("Invalid targetsdk: " + raw_targetsdk));