[backport camel-4.14.x] CAMEL-23843: Camel-PQC - sign and verify String payloads as UTF-8#24725
Open
oscerd wants to merge 1 commit into
Open
[backport camel-4.14.x] CAMEL-23843: Camel-PQC - sign and verify String payloads as UTF-8#24725oscerd wants to merge 1 commit into
oscerd wants to merge 1 commit into
Conversation
… payloads as UTF-8 sign/verify encoded a String message body with String.getBytes(), which uses the JVM default charset. The default charset is platform dependent, so signing on one JVM and verifying on another with a different default could disagree on the bytes of a non-ASCII payload and fail verification. Pin StandardCharsets.UTF_8. Charset-only backport of apache#24716. The native byte[]/InputStream handling from CAMEL-23847 is an improvement that stays on main only, so it is intentionally not part of this backport. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
gnodet
approved these changes
Jul 15, 2026
gnodet
left a comment
gnodet
left a comment
Contributor
There was a problem hiding this comment.
Identical backport to #24723 (already reviewed and approved for camel-4.18.x), targeting camel-4.14.x. Same minimal charset fix, same well-designed test. Looks good.
- Backport scope — charset fix only, no extra changes
- Tests — PQCSignatureCharsetTest pins the UTF-8 contract
- No other
.getBytes()calls in PQCProducer.java on this branch
Reviewed with Claude Code on behalf of gnodet. This review was generated by an AI agent and may contain inaccuracies; please verify all suggestions before applying.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #24716 to
camel-4.14.x(fixVersion 4.14.9) — charset only.sign/verifyencoded aStringbody withString.getBytes()(the JVM default charset). The default charset is platform dependent, so signing on one JVM and verifying on another with a different default disagrees on the bytes of a non-ASCII payload and verification fails. PinStandardCharsets.UTF_8.Scope vs main: the native
byte[]/InputStreamhandling delivered on main by CAMEL-23847 is an improvement kept tomain, so it is intentionally not in this backport — only the charset determinism fix forStringpayloads. This branch has no hybrid sign/verify, so onlysignature()/verification()are touched.Note on the test: the bug is JVM-default-charset dependent (a no-op on Java 18+ where the default is already UTF-8, per JEP 400), so the test pins the UTF-8 contract — it independently verifies the produced signature over the payload's UTF-8 bytes and confirms it does not match the ISO-8859-1 bytes. Validated green on this branch; no generated drift.
Claude Code on behalf of Andrea Cosentino.