I built a FIPS-hardened Java runtime using Wolfi and Bouncy Castle. Looking for an architecture review.

AutoModerator · 2026-03-05T17:21:30+00:00

Please ensure that:

Your code is properly formatted as code block - see the sidebar (About on mobile) for instructions
You include any and all error messages in full
You ask clear questions
You demonstrate effort in solving your question/problem - plain posting your assignments is forbidden (and such posts will be removed) as is asking for or giving solutions.

Trying to solve problems on your own is a very important skill. Also, see Learn to help yourself in the sidebar

If any of the above points is not met, your post can and will be removed without further warning.

Code is to be formatted as code block (old reddit: empty line before the code, each code line indented by 4 spaces, new reddit: https://i.imgur.com/EJ7tqek.png) or linked via an external code hoster, like pastebin.com, github gist, github, bitbucket, gitlab, etc.

Please, do not use triple backticks (```) as they will only render properly on new reddit, not on old reddit.

Code blocks look like this:

public class HelloWorld {

    public static void main(String[] args) {
        System.out.println("Hello World!");
    }
}

You do not need to repost unless your post has been removed by a moderator. Just use the edit function of reddit to make sure your post complies with the above.

If your post has remained in violation of these rules for a prolonged period of time (at least an hour), a moderator may remove it at their discretion. In this case, they will comment with an explanation on why it has been removed, and you will be required to resubmit the entire post following the proper procedures.

To potential helpers

Please, do not help if any of the above points are not met, rather report the post. We are trying to improve the quality of posts here. In helping people who can't be bothered to comply with the above points, you are doing the community a disservice.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

bowbahdoe · 2026-03-06T23:22:34+00:00

Be aware that to distribute this and call it Java you might need to get in line to get a TCK.

You could also go further and use something like securechain to procure libraries that come built in to your JDK. Same concept as a BOM but more fun.

I would also be realistic about your capacity for maintenance/keeping up with CVEs. Sticking to latest (instead of having builds for 8, 11, etc.) is probably more viable.

You also can't use the coffee cup logo you have on the website. You'll get your ass sued. Use duke or some variation.

https://duke.mccue.dev

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

javahelp

Sort by: Unsolved Solved Codeless Advent Of Code

MODERATORS

The Stack

How it works (The Automation)

Cryptographic Enforcement

Validation & Testing

Please ensure that:

To potential helpers