oscerd commented on PR #29092: URL: https://github.com/apache/camel/pull/29092#issuecomment-6821762412
Pushed `CAMEL-26545: Document the post-quantum named group behaviour - 4.24 upgrade guide note, the JSSE page describes the hybrids, the kept order and when the INFO line appears, and JDK 27 (JEP 527) replaces JDK 25`, rebased on `main`. It addresses both follow-up reviews: - **Upgrade guide** (gnodet-bot and davsclaus): a note in `camel-4x-upgrade-guide-4_24.adoc` on the three changes: the NIST hybrids count, an order that already leads with a hybrid is kept, and the `INFO` line `Auto-configured PQC named groups` is logged only on a reorder, with a `DEBUG` line otherwise and the advice to read `getSSLParameters().getNamedGroups()` of a created engine or socket instead. One correction to the review: the "no post-quantum group" message did not exist on `main`, which was silent in that case. The first commit of this PR introduced it at `INFO` and the second moved it to `DEBUG`, so nobody could have monitored it, and the note does not present it as an `INFO` to `DEBUG` change. - **JSSE page** (davsclaus): the Auto-Configuration section now says which hybrids count, that the activation also needs an order that does not already lead with a hybrid, that the `INFO` line appears only on a reorder and a `DEBUG` line otherwise, and how to verify the preferred group. The "disable" example excludes all three hybrids. - **JDK version**: the page, the Javadoc and the `DEBUG` message said JDK 25. Checked on Temurin 24.0.1 and 25.0.4: neither enables a hybrid by default, and `-Djdk.tls.namedGroups=X25519MLKEM768,SecP256r1MLKEM768,SecP384r1MLKEM1024,x25519` leaves `x25519` alone, so SunJSSE there does not know the groups. They arrive with JEP 527 in JDK 27: `NamedGroup.SupportedGroups.defaultGroups` at the `jdk-27-ga` tag is `X25519MLKEM768, X25519, SECP256_R1, SECP384_R1, SECP521_R1, X448, FFDHE_2048, FFDHE_3072, FFDHE_4096`, so a stock JDK 27 already leads with the hybrid, and the `SecP*` hybrids are enabled only on request. All three places say JDK 27 (JEP 527) now, and the "JDK 25+" rows of the comparison table and the migration steps on the same page were corrected as well. - **PR description**: CI builds on JDK 21, where the auto-configuration tests take the "no hybrid" branch, and on a stock JDK 27 the order already leads with `X25519MLKEM768`, so the branch under the lock runs only on a JVM that enables a hybrid without leading with it. The description says so now. - **Javadoc**: `<p>` instead of `<p/>` in the two paragraphs of the touched methods (CAMEL-21356). Re-requested the review. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
