[cconlon]

This PR makes WolfCryptSignature.engineSign() throw SignatureException when native signing fails, as JCA requires. Before, a WolfCryptException from native RSA, RSA-PSS or ECDSA signing escaped Signature.sign(). For example, FIPS v7 rejects an RSA-PSS salt longer than the hash, per FIPS 186-5 §5.4(g).

Changes

• Catch WolfCryptException in engineSign() and rethrow it as SignatureException with the original as the cause, matching the EdDSA, ML-DSA and SLH-DSA classes.
• Add testRsaPssSignNativeErrorThrowsSignatureException.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #296

Scan targets checked: wolfcrypt-jni-src, wolfcrypt-jni-bugs
Coverage: 1 of 2 in-scope changed file(s) opened by the reviewer; not opened: src/test/java/com/wolfssl/provider/jce/test/WolfCryptSignatureTest.java

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

[Copilot]

🟡 Changes recommended

The regression test should verify that the original native exception is preserved as the cause.

1 open finding

• Assert preservation of the native exception as the cause · New

What changed in this PR

Wraps native signing failures in JCA-compatible SignatureException instances.

Changes:

• Converts native RSA, RSA-PSS, and ECDSA signing errors.
• Adds an RSA-PSS native-error regression test.

File	Description
WolfCryptSignature.java	Wraps native signing failures.
WolfCryptSignatureTest.java	Tests RSA-PSS failure behavior.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.