Camel 4.23 is planned for October and it adds a new component, camel-spiffe. The problem it solves is not obvious if you have never looked at SPIFFE, so I want to explain what it is for, what it does, and point at the example I wrote for it. The problem Two services that talk to each other need to know who is on the other side. The usual answer is a credential that one side stores and the other side checks: an API key in a properties file, a password in a Kubernetes secret, a client certificate that somebody generated years ago.
Continue reading ❯
SECURITYCAMEL
Camel 4.21.0 shipped on 1 July with 32 security fixes. 4.18.3 followed on 3 July with 34, and 4.14.8 on 4 July with 27. All three supported release lines were patched inside four days, and every finding got a signed public advisory. A batch of 32 gets noticed, usually for the wrong reason. So I want to write about the process that produced it rather than walk through the list. If you are running Camel in production, the number of advisories in a release tells you very little.
Continue reading ❯
SECURITY
If your security or compliance team has started asking “does it ship with an SBOM?”, you are not alone. The EU Cyber Resilience Act (CRA) will require SBOM delivery for software sold in the EU, US Executive Order 14028 and NIST guidance make SBOMs a federal procurement expectation, and enterprise evaluation checklists increasingly treat SBOM availability as a gate. Apache Camel has shipped SBOMs with every release since 4.0.3 — long before these regulations finalized.
Continue reading ❯
SECURITY