oscerd opened a new pull request, #26016:
URL: https://github.com/apache/camel/pull/26016
## Backport of #25510
`main` and `camel-4.22.x` both carry this fix (#25510, #25753).
`camel-4.18.x` was the one line still missing it.
## The problem
The GitHub runner image ships **Temurin 25.0.4+7**. On that JDK a JKS
`KeyStore` deserialises standardised PQC keys (ML-DSA, ML-KEM) into JDK-native
key objects, which Bouncy Castle's `Signature` SPI refuses:
```
java.security.InvalidKeyException: unknown private key passed to ML-DSA
at org.bouncycastle.jcajce.provider.asymmetric.mldsa.SignatureSpi.signInit
at
org.apache.camel.component.pqc.PQCProducer.signature(PQCProducer.java:494)
```
`PQCProducer` loads the key from the KeyStore but obtains the `Signature`
explicitly from BC — a provider mismatch. `PQCSignatureWithKeyStoreTest` and
`PQCSignatureOnlyKeyStoreTest` fail; the non-KeyStore tests pass because they
generate the pair through BC directly.
It is latent on this branch today: it only surfaces when a PR's fan-out
pulls `camel-pqc` into the test scope.
## :warning: Hand-adapted, not a clean cherry-pick
This branch does not have the **hybrid signature operations** (`hybridSign`
/ `hybridVerify`) that surround the change on `main`, so a straight cherry-pick
offered to insert that whole feature. It was dropped — backporting it under a
fix would be wrong. Only the key conversion is taken.
Two further adaptations this branch needed:
- **A private `LOG` was added to `PQCProducer`.** The conversion logs at
debug; this branch previously relied on `DefaultProducer`'s own logger, which
is private, so the code did not compile without it.
- **`assertj-core` was added as a test dependency.** This module did not
declare it, though other components on this branch already do.
## Verification
Run on **Temurin 25.0.4+7**, the exact JDK the runner ships:
- **114 tests pass**, including the backported
`PQCKeyStoreJdk25KeyConversionTest` and the two KeyStore signature tests that
fail without it.
- With the `ensureBcKeyPair` call temporarily commented out,
`PQCSignatureWithKeyStoreTest` **fails** — so the change is load-bearing here,
not incidental.
The test was rewritten from `camel-test-junit6` to `camel-test-junit5`,
which is what this branch uses.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
