Fixes for cert name locking, session cache validity, hostname log sanitization, and build/CI hardening

[cconlon]

This PR includes 8 Fenrir fixes:

• F-5638: Hold WolfSSLX509Name monitor while setting a subject or issuer name so native pointer stays valid.
• F-5715: Skip resuming an invalidated session and re-check validity before caching one.
• F-5739: Honor sz argument in memrestoreCertCache, rejecting non-positive or oversized values.
• F-5741: Sanitize peer hostname before WolfSSLEngineHelper debug output via a shared helper.
• F-5777: Apply sanitization to the WolfSSLAuthStore, WolfSSLSocket, WolfSSLSocketFactory, and WolfSSLImplementSSLSession.
• F-10765: Document that jdk.tls.disabledAlgorithms applies to protocols and key sizes but not cipher suites.
• F-10751: Verify the JUnit and Hamcrest test jars against checked-in SHA-256 digests in Maven CI.
• F-10753: Pin the ant compile classpath to two project jars instead of a lib/*.jar wildcard.

[Copilot]

Pull request overview

This PR delivers a set of hardening and correctness fixes across the wolfSSL JNI layer, wolfJSSE session caching/resumption logic, debug logging, and build/CI workflows.

Changes:

• Tighten JNI/native pointer safety and cache restore argument validation (X509 name pointer locking + cert cache size enforcement).
• Improve session resumption correctness by avoiding reuse/caching of invalidated sessions, with added regression tests.
• Reduce log-injection risk via a shared hostname/log sanitization helper and apply it across JSSE components; also harden Ant/Maven CI dependency handling.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/test/com/wolfssl/test/WolfSSLContextTest.java	Adds negative tests to ensure cert cache restore rejects invalid sizes.
src/test/com/wolfssl/provider/jsse/test/WolfSSLSessionTest.java	Adds a regression test ensuring invalidated sessions are not resumed.
src/java/com/wolfssl/WolfSSLX509Name.java	Documents and clarifies native pointer validity expectations for callers.
src/java/com/wolfssl/WolfSSLDebug.java	Introduces shared log sanitization utility for unsafe characters.
src/java/com/wolfssl/WolfSSLCRL.java	Holds the X509Name monitor while passing the native name pointer into JNI.
src/java/com/wolfssl/WolfSSLContext.java	Updates memrestoreCertCache Javadoc to match stricter size semantics.
src/java/com/wolfssl/WolfSSLCertificate.java	Adds null checks and synchronizes on WolfSSLX509Name during native calls.
src/java/com/wolfssl/provider/jsse/WolfSSLSocketFactory.java	Sanitizes hostname values in debug logging.
src/java/com/wolfssl/provider/jsse/WolfSSLSocket.java	Sanitizes hostname values in debug logging; adds disabledAlgorithms note for cipher suites.
src/java/com/wolfssl/provider/jsse/WolfSSLServerSocket.java	Adds disabledAlgorithms note for cipher suite enabling.
src/java/com/wolfssl/provider/jsse/WolfSSLImplementSSLSession.java	Sanitizes hostname in session creation debug logging.
src/java/com/wolfssl/provider/jsse/WolfSSLEngineHelper.java	Sanitizes peer hostname in helper construction debug logging.
src/java/com/wolfssl/provider/jsse/WolfSSLEngine.java	Adds disabledAlgorithms note for cipher suite enabling.
src/java/com/wolfssl/provider/jsse/WolfSSLAuthStore.java	Avoids resuming/caching invalid sessions; sanitizes host/cacheKey in debug logs.
native/com_wolfssl_WolfSSLContext.c	Enforces sz bounds and uses it as the restore length for cert cache restore.
build.xml	Pins Ant test classpath to the two project jars rather than lib/*.jar.
.github/workflows/maven.yml	Adds Maven dependency resolution and checksum verification for test jars before running tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.