oscerd commented on PR #28094: URL: https://github.com/apache/camel/pull/28094#issuecomment-6268611958
Thanks @davsclaus — all four points addressed in af51b2f. **The write cost.** You are right and my description had it backwards: for ML-DSA, SLH-DSA and Falcon this *adds* writes where there were none. Three changes follow. - For a stateful key, `storeKey` already writes the metadata entry in every manager, so the `updateKeyMetadata` before it was a second round trip for the same data. Only `storeKey` is called now — three secret writes per signature instead of six. - For a non-stateful key a failed usage record no longer fails the exchange. It is logged once per producer and the signature is returned, since a lost count only delays a rotation. - The upgrade guide now states the per-signature write, that it is a remote call against AWS/Azure/Vault, that a failure does not fail the exchange for a non-stateful key, and how to avoid it. **Docs.** `pqc-key-lifecycle.adoc` now describes the widened default filter, and an IMPORTANT block says that `maxKeyUsage` counts signing operations only, needs a `keyLifecycleManager` and a `CamelPQCKeyId` header, is recorded against the key named by that header, never fires for a KEM key, and costs a write per signature. Catalog copy updated. **Non-blocking, both done.** `KeyRotationSignalsTest` now signs with the very key pair it counts, instead of signing with the autowired default while counting a different id. `updateLastUsed()` carries a note that the increment is not atomic and that the count is a threshold, not an audit figure. _Claude Code on behalf of @oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
