[cconlon]

This PR adds module-info.java so the filtered-providers jar is a named JPMS module, com.wolfssl.security.providers, in both the ant and Maven builds. Module-path users can aim --add-opens / --add-exports at a stable module name, and the providers register through ServiceLoader, so JDK tools such as keytool, which ignore CLASSPATH, can load them.

• ant: compiles module-info into filtered-providers.jar, test-filtered-providers now runs the suite on both the class path and the module path
• Maven: the filtered-providers classified jar now includes module-info instead of Automatic-Module-Name, maven-compiler-plugin bumped to 3.16.0 (3.12+ needed for a configurable outputDirectory)
• CI: both jar checks expect a named module

With this change Maven does prints a harmless Overwriting artifact's file warning when compiling the second module-info. The main jar step resets it, so published artifacts are unaffected.

[cconlon]

@claude review

[wolfSSL-Bot]

All Tests Successfully Launched.

[Copilot]

🟡 Changes recommended

The module-path tests manually register providers rather than exercise ServiceLoader discovery, so a missing provider declaration could break JDK-tool discovery without failing the suite.

1 open issue

• Add module-path ServiceLoader coverage for all three providers · New

What changed in this PR

Makes the filtered-providers jar a named JPMS module, com.wolfssl.security.providers, supporting stable access flags and provider discovery through ServiceLoader.

Changes:

• Adds a module descriptor exporting the provider package and registering all three providers.
• Updates Ant and Maven packaging, adds Ant module-path tests, and checks named-module artifacts in CI.
• Documents module-path deployment and the required access flags.

File	Description
pom.xml	Compiles the module descriptor into the classified jar and updates the compiler plugin.
examples/​filtered-providers/​README.md	Documents named-module deployment and access flags.
examples/​filtered-providers/​java9/​module-info.java	Defines the module, package export, and provider registrations.
examples/​filtered-providers/​docs/​add-opens.md	Explains flag targets for class-path and module-path use.
build.xml	Packages the descriptor and runs filtered-provider tests on both paths.
.github/​workflows/​filtered-providers.yml	Verifies that Ant and Maven jars contain the expected explicit module.

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #304

Scan targets checked: wolfcrypt-jni-pr-general
Review type: general (no scan target covers the changed files)
Coverage: 5 of 6 in-scope changed file(s) opened by the reviewer; not opened: examples/filtered-providers/java9/module-info.java

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Max

[claude]

I reviewed this PR and didn't find any bugs. It's still worth a human look, because it upgrades maven-compiler-plugin for the whole Maven build and uses an extra compile execution that triggers the "Overwriting artifact's file" warning.

What was reviewed:

• module-info.java: the provider sources import only java.base types, so the module needs no requires. The provides list matches the three provider classes.
• Ant: compiling java9/ alongside src/ gives one module. The second junit run puts the classpath tests in the unnamed module, which can read the exported package. Every add-opens/add-exports flag now targets com.wolfssl.security.providers.
• Maven: copy-resources now runs at process-classes, before the module-info compile at prepare-package. The CI --describe-module checks fail if module-info.class is missing or the module is automatic.

Extended reasoning...

This change touches only build and packaging files (build.xml, pom.xml, the CI workflow) and docs, plus a new module-info.java for the filtered-providers example jar. It changes no crypto or JNI code. Two things led to deferring rather than approving. First, maven-compiler-plugin goes from 3.11.0 to 3.16.0, which affects every compile execution, including the main wolfcrypt-jni jar. Second, the Maven profile relies on a second compile execution with a custom outputDirectory, and I could not run the Maven or Ant builds here to confirm either one.

[cconlon]

Failing FIPS Ready test will be fixed with #305. Will rebase once that gets merged in.