gnodet opened a new pull request, #25510: URL: https://github.com/apache/camel/pull/25510
## Summary - Fix `InvalidKeyException: unknown private key passed to ML-DSA` when using PQC KeyStore-based signing on Java 25 - Re-encode JDK-native PQC keys through Bouncy Castle's `KeyFactory` after loading from a KeyStore or user-supplied KeyPair, transparently converting them to BC types - No-op on Java 17/21 where JKS always returns BC key instances ## Root Cause Java 25 natively supports ML-DSA ([JEP 497](https://openjdk.org/jeps/497)). When a Bouncy Castle ML-DSA private key is stored in a JKS KeyStore and retrieved, the JDK's built-in ML-DSA `KeyFactory` deserializes it as a **JDK-native** ML-DSA key object. When this key is passed to BC's `Signature.getInstance("ML-DSA", "BC").initSign()`, BC does not recognize it: ``` java.security.InvalidKeyException: unknown private key passed to ML-DSA at org.bouncycastle.jcajce.provider.asymmetric.mldsa.SignatureSpi.signInit at PQCProducer.signature(PQCProducer.java:494) ``` SLH-DSA KeyStore tests **pass** because Java 25 does not (yet) provide a native SLH-DSA `KeyFactory`, so those keys remain as BC objects after deserialization. This is a follow-up to the CAMEL-22114 fix (commit 91c6190), which addressed provider-less `Signature.getInstance()` calls. The KeyStore deserialization path was not covered by that fix and was exposed by the July 2026 PQC features (CAMEL-22538, CAMEL-23844, CAMEL-23847, CAMEL-23848, CAMEL-23849) that added KeyStore-based test cases. ## Evidence CI runs [31861106711](https://github.com/apache/camel/actions/runs/31861106711) and [31848843987](https://github.com/apache/camel/actions/runs/31848843987) show `Camel :: PQC FAILURE [45.849 s]` on Java 25 while Java 17 passes. The `Main build` workflow only runs `regen.sh` (no tests), so this failure is latent on `main`. ## Test plan - [x] All 210 camel-pqc tests pass on Java 21 (verified locally) - [ ] `PQCSignatureOnlyKeyStoreTest` passes on Java 25 (CI) - [ ] `PQCSignatureWithKeyStoreTest` passes on Java 25 (CI) - [ ] No regressions on Java 17 (CI) _Claude Code on behalf of gnodet_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
