oscerd opened a new pull request, #29555: URL: https://github.com/apache/camel/pull/29555
Jira: https://issues.apache.org/jira/browse/CAMEL-26588 ### Problem The claim that keeps a stateful signature key (XMSS, XMSSMT, LMS, HSS) to one process was keyed by the `CamelPQCKeyId` header: `FileBasedKeyLifecycleManager` locked `<keyId>.lock`. So an exchange carrying a different header value claimed a different lock file while signing with the same endpoint `keyPair`, and an exchange carrying no header was not claimed at all. The lock did not bind to the key material it is meant to protect. Raised by davsclaus while reviewing #29098; the first half of CAMEL-26588 (the holder count) was fixed there. ### Change - `KeyLifecycleManager.claimStatefulKey` and `releaseStatefulKey` take the public key next to the name: `claimStatefulKey(String keyId, PublicKey publicKey)` and `releaseStatefulKey(String keyId, PublicKey publicKey)`, both still with a default implementation. The name may be `null` for a key the exchange gives no name to. A new `KeyLifecycleManager.fingerprint(PublicKey)` gives the SHA-256 hex digest of the encoded public key, for custom managers to key their lease on. These methods are new in 4.24 and unreleased. - `FileBasedKeyLifecycleManager` names the lock file from that fingerprint, so the same key under two names, or under none, contends for one file; two different keys under one name do not. A key whose public key gives no encoding is claimed under its name, confined to the key directory as before. Messages name the key, or its fingerprint when it has no name. - `PQCProducer` claims once per producer, on its key material, under the name the first exchange gives the key or none, and releases that claim when it stops. The stored copy is still re-read once per name after the claim (the adoption of a key another instance advanced), and the usage recording is unchanged. ### Tests - `FileBasedKeyLifecycleManagerStatefulClaimTest`: the claim follows the key, not its name; different keys under one name do not contend; an unnamed key is claimed and refused to a second manager; a key without an encoding is claimed by its name and refused without one; a name that escapes the directory is rejected only when it names the lock file. The existing cases (holders, registry, symbolic link, store re-read, concurrency) are adapted. - `PQCStatefulKeyClaimIdentityTest` (new, file-based manager in a temporary directory): exchanges naming the key differently take one lock named from the fingerprint, and an exchange without the header is claimed too. - `PQCStatefulKeyClaimTest`: an unnamed stateful key that cannot be claimed is refused as a named one is. ### Documentation The "Single Ownership of a Stateful Key" section of the key-lifecycle page and the 4.24 upgrade-guide entry describe the fingerprint-based lock, the no-header case and the new method signatures. Catalog copy updated. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
