[backport camel-4.18.x] CAMEL-23843: Camel-PQC - sign and verify String payloads as UTF-8

[oscerd]

Backport of #24716 to camel-4.18.x (fixVersion 4.18.4) — charset only.

sign/verify encoded a String body with String.getBytes() (the JVM default charset). The default charset is platform dependent, so signing on one JVM and verifying on another with a different default disagrees on the bytes of a non-ASCII payload and verification fails. Pin StandardCharsets.UTF_8.

Scope vs main: the native byte[]/InputStream handling delivered on main by CAMEL-23847 is an improvement kept to main, so it is intentionally not in this backport — only the charset determinism fix for String payloads. This branch has no hybrid sign/verify, so only signature()/verification() are touched.

Note on the test: the bug is JVM-default-charset dependent (a no-op on Java 18+ where the default is already UTF-8, per JEP 400), so the test pins the UTF-8 contract — it independently verifies the produced signature over the payload's UTF-8 bytes and confirms it does not match the ISO-8859-1 bytes. Validated green on this branch; no generated drift.

Claude Code on behalf of Andrea Cosentino.

[gnodet]

Well-scoped, minimal backport of the charset determinism fix — looks good.

What works well:

• The fix is correct and complete: both signature() and verification() now use StandardCharsets.UTF_8 instead of the platform-dependent String.getBytes().
• No other .getBytes() calls exist in PQCProducer.java on this branch, so nothing is missed.
• The test design is solid — independently verifying the signature over UTF-8 bytes and confirming it does not match ISO-8859-1 bytes pins the UTF-8 contract regardless of the JVM's default charset.
• Backport scope is appropriate: only the charset fix, no hybrid crypto code (which correctly doesn't exist on camel-4.18.x).

Checklist:

• Tests included (PQCSignatureCharsetTest)
• No @author tags
• Backport scope — minimal, targeted fix only
• Backward compat — improves cross-platform correctness
• Security — deterministic encoding prevents subtle signature verification failures
• Formatting — import placement correct

Reviewed with Claude Code on behalf of gnodet. This review was generated by an AI agent and may contain inaccuracies; please verify all suggestions before applying.