oscerd opened a new pull request, #25825: URL: https://github.com/apache/camel/pull/25825
Fixes [CAMEL-24445](https://issues.apache.org/jira/browse/CAMEL-24445). PQCProducer cached a single java.security.Signature in a field, and signature(), verification() and the two hybrid operations each ran a full init -> update -> sign/verify sequence on it with no synchronization. A Camel producer is a singleton invoked concurrently, and Signature carries state across that sequence, so the sequences interleave. That does not merely corrupt output: a concurrent initVerify can reset the object between another exchange's updates and its verify(), so the result stops corresponding to the message it was called for. updateSignatureFromBody streams the body in chunks, which widens the window. signerForExchange() now returns a fresh instance when the producer created the Signature itself - the algorithm and provider are recorded at doStart() - which removes the sharing. When the user configured an instance it is returned as-is, because PQCDefault*Material.signer are public static final and a configured instance may be shared JVM-wide, and callers serialize on whatever they get. The hybrid paths take both locks PQC-first so the nesting order is the same in sign and verify. A concurrency test drives 8 threads x 40 messages through sign -> verify. Without the fix it errors out of BouncyCastle's ML-DSA SignatureSpi ("attempt to absorb with odd length queue", and a null-array NPE) from the shared signer.sign(). Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Signed-off-by: Andrea Cosentino <[email protected]> \n## Verification\n\n2 files changed, including 1 test file(s). Module build with \`-am\` is green on current main, no generated-file drift. Verified against the pre-fix code when the change was written. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
