You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/07/14 08:09:44 UTC
[PR] CAMEL-23845: Camel-PQC - implement InMemoryKeyLifecycleManager [camel]
oscerd opened a new pull request, #24676:
URL: https://github.com/apache/camel/pull/24676
# CAMEL-23845: Camel-PQC — implement InMemoryKeyLifecycleManager
## Motivation
`pqc-key-lifecycle.adoc` references an **`InMemoryKeyLifecycleManager`** in eight places — a dedicated
subsection, code examples, the implementation comparison table, the "Testing Strategy" section and a
migration example — but **the class was never committed**. So the documented examples did not compile,
and a genuinely useful implementation was missing.
## What this does
### `InMemoryKeyLifecycleManager` (new)
A `ConcurrentHashMap`-backed `KeyLifecycleManager` that performs no I/O — keys are lost when the
application stops. Ideal for tests, development and ephemeral workloads.
- Implements the full `KeyLifecycleManager` contract (generate, store, get, rotate, expire, revoke,
list, delete, export/import, `needsRotation`).
- Thread-safe, as the docs claim.
- Adds the two documented helpers: **`clear()`** and **`size()`**.
### `KeyAlgorithmSupport` (new, shared)
`FileBasedKeyLifecycleManager` held the algorithm mapping (JCE algorithm name, BouncyCastle provider,
default parameter set) plus the key-generation logic in **private** methods. Rather than copy ~80 lines
into the new manager, that logic is extracted into a `KeyAlgorithmSupport` helper that **both**
implementations now use. `FileBasedKeyLifecycleManager`'s behaviour is unchanged — it just delegates.
## Documentation
None needed: the existing examples (including the migration snippet and the `clear()`-based test setup)
already match this API exactly. They now actually compile.
## Testing
New `InMemoryKeyLifecycleManagerTest` (11 tests): generate/retrieve, unknown-key handling, rotation
(old → DEPRECATED, new → ACTIVE), rotation of an unknown key rejected, expire/revoke, list/delete,
`needsRotation` by age and usage, PEM export/import round trip, `clear()`/`size()`, and a concurrent
key-generation test covering the documented thread-safety.
The existing FileBased suites (`PQCKeyLifecycleTest` 18, `PQCKeyLifecycleIntegrationTest` 10) still pass
unchanged, confirming the extraction is behaviour-preserving — **39 green** in total. Full reactor build
green.
## Backport
None — improvement, `main` only (4.22.0).
---
_Claude Code on behalf of Andrea Cosentino._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23845: Camel-PQC - implement InMemoryKeyLifecycleManager [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #24676:
URL: https://github.com/apache/camel/pull/24676#issuecomment-4967051979
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23845: Camel-PQC - implement InMemoryKeyLifecycleManager [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on PR #24676:
URL: https://github.com/apache/camel/pull/24676#issuecomment-4968510632
Thanks for the review @davsclaus. Both observations checked out — one is now fixed, one I'd like to keep as-is. Details below.
## 1. Log-level inconsistency in `InMemoryKeyLifecycleManager` — **fixed**
Good catch, and it turned out to be more than cosmetic. Checking against the three existing implementations, they all agree with each other and the new class was the sole outlier:
| Event | `FileBased` | `AwsSecretsManager` | `HashicorpVault` | `InMemory` (before) |
|---|---|---|---|---|
| `Generating key pair…` | INFO | INFO | INFO | **DEBUG** |
| `Generated key pair…` | INFO | INFO | INFO | **DEBUG** |
| `Deleted key…` | INFO | INFO | INFO | **DEBUG** |
| rotate / expire / revoke | INFO | INFO | INFO | INFO |
| internal store plumbing | DEBUG | DEBUG | DEBUG | _(no log)_ |
Key generation and key deletion are security-relevant lifecycle events, and `KeyLifecycleManager` implementations are meant to be interchangeable — so as written, swapping `FileBasedKeyLifecycleManager` for `InMemoryKeyLifecycleManager` would have silently dropped those two lines from an INFO-level audit log.
Those three calls are now INFO, so all four implementations log the same lifecycle events at the same level, and DEBUG stays reserved for internal plumbing.
## 2. Wildcard import in `KeyAlgorithmSupport` — **keeping as-is**
You're right that it was carried over from `FileBasedKeyLifecycleManager` (which this PR does clean up — the now-unused BouncyCastle imports go away along with the four extracted methods). But it is the established pattern for that package rather than a new deviation, and the conditional risk you flagged doesn't materialise:
- `HashicorpVaultKeyLifecycleManager` and `AwsSecretsManagerKeyLifecycleManager` both carry the **identical** `import org.bouncycastle.pqc.jcajce.spec.*;` on `main` today.
- It covers **12 distinct classes** from that single package in `KeyAlgorithmSupport` — the `BIKE`, `CMCE`, `Falcon`, `Frodo`, `HQC`, `LMSKeyGen`, `NTRU`, `NTRULPRime`, `SABER`, `SNTRUPrime`, `XMSS` and `XMSSMT` parameter specs — which is precisely why the wildcard is there.
- `formatter:format` and `impsort:sort` are both bound to `process-sources` in this module, so the module build does run them: it leaves the file untouched, no expansion and nothing to commit. That matches the green CI on this PR, formatting gate included.
Expanding it would make `KeyAlgorithmSupport` the only file in the package importing those specs one by one, so I'd rather keep the module self-consistent. Happy to do a separate sweep across all of `camel-pqc` if you'd prefer the explicit style module-wide — that's a bigger change than this PR should carry.
---
All 25 `camel-pqc` lifecycle tests still pass (11 `InMemoryKeyLifecycleManagerTest` + 9 `KeyRotationSchedulerTest` + 5 `KeyMetadataCodecTest`), and the full reactor build is green.
_Claude Code on behalf of Andrea Cosentino._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23845: Camel-PQC - implement InMemoryKeyLifecycleManager [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #24676:
URL: https://github.com/apache/camel/pull/24676#issuecomment-4967511605
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `components/camel-pqc`
---
<details><summary>:microscope: Scalpel shadow comparison — Scalpel: 9 tested, 29 compile-only — current: 9 all tested</summary>
[Maveniverse Scalpel](https://github.com/maveniverse/scalpel) detected **38 affected modules** (current approach: 9).
<details><summary>:warning: Modules only in Scalpel (29)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog`
- `camel-catalog-console`
- `camel-catalog-lucene`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-csimple-maven-plugin`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `docs`
- `dummy-component`
</details>
**Skip-tests mode would test 9 modules** (1 direct + 8 downstream), **skip tests for 29** (generated code, meta-modules)
<details><summary>Modules Scalpel would test (9)</summary>
- `camel-jbang-mcp`
- `camel-jbang-plugin-mcp`
- `camel-jbang-plugin-route-parser`
- `camel-jbang-plugin-tui`
- `camel-jbang-plugin-validate`
- `camel-launcher-container`
- `camel-pqc`
- `camel-yaml-dsl-validator`
- `camel-yaml-dsl-validator-maven-plugin`
</details>
<details><summary>Modules with tests skipped (29)</summary>
- `apache-camel`
- `camel-allcomponents`
- `camel-catalog`
- `camel-catalog-console`
- `camel-catalog-lucene`
- `camel-catalog-maven`
- `camel-catalog-suggest`
- `camel-componentdsl`
- `camel-csimple-maven-plugin`
- `camel-endpointdsl`
- `camel-endpointdsl-support`
- `camel-itest`
- `camel-jbang-core`
- `camel-jbang-it`
- `camel-jbang-main`
- `camel-jbang-plugin-edit`
- `camel-jbang-plugin-generate`
- `camel-jbang-plugin-kubernetes`
- `camel-jbang-plugin-test`
- `camel-kamelet-main`
- `camel-launcher`
- `camel-report-maven-plugin`
- `camel-route-parser`
- `camel-yaml-dsl`
- `camel-yaml-dsl-deserializers`
- `camel-yaml-dsl-maven-plugin`
- `coverage`
- `docs`
- `dummy-component`
</details>
> :information_source: Shadow mode — Scalpel observes but does not affect test execution. [Learn more](https://github.com/maveniverse/scalpel)
</details>
<details><summary>All tested modules (38 modules)</summary>
- Camel :: All Components Sync point
- Camel :: Assembly
- Camel :: Catalog :: CSimple Maven Plugin (deprecated)
- Camel :: Catalog :: Camel Catalog
- Camel :: Catalog :: Camel Report Maven Plugin
- Camel :: Catalog :: Camel Route Parser
- Camel :: Catalog :: Console
- Camel :: Catalog :: Dummy Component
- Camel :: Catalog :: Lucene (deprecated)
- Camel :: Catalog :: Maven
- Camel :: Catalog :: Suggest
- Camel :: Component DSL
- Camel :: Coverage
- Camel :: Docs
- Camel :: Endpoint DSL
- Camel :: Endpoint DSL :: Support
- Camel :: Integration Tests
- Camel :: JBang :: Core
- Camel :: JBang :: Integration tests
- Camel :: JBang :: MCP
- Camel :: JBang :: Main
- Camel :: JBang :: Plugin :: Edit
- Camel :: JBang :: Plugin :: Generate
- Camel :: JBang :: Plugin :: Kubernetes
- Camel :: JBang :: Plugin :: MCP
- Camel :: JBang :: Plugin :: Route Parser
- Camel :: JBang :: Plugin :: TUI
- Camel :: JBang :: Plugin :: Testing
- Camel :: JBang :: Plugin :: Validate
- Camel :: Kamelet Main
- Camel :: Launcher
- Camel :: Launcher :: Container
- Camel :: PQC
- Camel :: YAML DSL
- Camel :: YAML DSL :: Deserializers
- Camel :: YAML DSL :: Maven Plugins
- Camel :: YAML DSL :: Validator
- Camel :: YAML DSL :: Validator Maven Plugin
</details>
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/29317041765)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23845: Camel-PQC - implement InMemoryKeyLifecycleManager [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd merged PR #24676:
URL: https://github.com/apache/camel/pull/24676
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org