[backport camel-4.22.x] CAMEL-22114: Fix PQC KeyStore tests on Java 25 (InvalidKeyException) - #25753
Merged
Merged
Conversation
…25510) * CAMEL-22114: Fix PQC KeyStore tests on Java 25 (InvalidKeyException) On JDK 25+, the JKS KeyStore deserialises ML-DSA keys as JDK-native key objects that Bouncy Castle's Signature SPI does not recognise, causing InvalidKeyException: unknown private key passed to ML-DSA. Re-encode keys through BC's KeyFactory after loading from a KeyStore (or from user-supplied KeyPair). This transparently converts JDK-native PQC keys into BC types and is a no-op for keys that are already BC instances. Fixes PQCSignatureOnlyKeyStoreTest and PQCSignatureWithKeyStoreTest on Java 25. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * CAMEL-22114: Add dedicated regression test for Java 25 PQC key conversion Add @EnabledForJreRange(min = JAVA_25) test that validates ML-DSA sign+verify via JKS KeyStore works after the JDK-native key to BC key conversion fix. Skipped on Java <25 where the conversion is a no-op. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Claus Ibsen <claus.ibsen@gmail.com>
Contributor
|
🌟 Thank you for your contribution to the Apache Camel project! 🌟 🐫 Apache Camel Committers, please review the following items:
|
Contributor
|
🧪 CI tested the following changed modules:
🔬 Scalpel shadow comparison — Scalpel: 9 tested, 29 compile-only — current: 9 all testedMaveniverse Scalpel detected 38 affected modules (current approach: 9).
|
gnodet
approved these changes
Aug 26, 2026
gnodet
left a comment
gnodet
left a comment
Contributor
There was a problem hiding this comment.
Clean backport of #25510 to camel-4.22.x. The diff is byte-for-byte identical to the merged original. CI is green. The fix correctly re-encodes JDK-native PQC keys through BC's KeyFactory to avoid InvalidKeyException on Java 25+, with a well-gated regression test (@EnabledForJreRange(min = JAVA_25)).
📋 PR Metadata
| Aspect | Current | Suggested |
|---|---|---|
| Labels | components |
+ bug |
| Milestone | (none) | 4.22.1 |
This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.
Claude Code on behalf of Guillaume Nodet
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #25510
Cherry-pick of #25510 onto
camel-4.22.x.Original PR: #25510 - CAMEL-22114: Fix PQC KeyStore tests on Java 25 (InvalidKeyException)
Original author: @gnodet
Target branch:
camel-4.22.xOriginal description
Summary
InvalidKeyException: unknown private key passed to ML-DSAwhen using PQC KeyStore-based signing on Java 25KeyFactoryafter loading from a KeyStore or user-supplied KeyPair, transparently converting them to BC typesRoot Cause
Java 25 natively supports ML-DSA (JEP 497). When a Bouncy Castle ML-DSA private key is stored in a JKS KeyStore and retrieved, the JDK's built-in ML-DSA
KeyFactorydeserializes it as a JDK-native ML-DSA key object. When this key is passed to BC'sSignature.getInstance("ML-DSA", "BC").initSign(), BC does not recognize it.See original PR for full details.
Claude Code on behalf of davsclaus