PQC support backports for 3.105 - #7973
Merged
Merged
Conversation
Generated-By: claude-opus-4.6 (cherry picked from commit 9a1bde6)
Use pysequoia instead, or shell out to gpg on the command line, which is what python-gnupg does anyway. It's not much additional code to just ditch the dependency everywhere. Assisted-By: claude-opus-4.6 (cherry picked from commit bc6396a)
Restore python-gnupg to functional tests only - not worth trying to replace this fixture like-for-like Fix an issue with inlined signatures. We should only parse the sig separately in the detached case. (cherry picked from commit ac64ff3)
(cherry picked from commit 1d46c31)
We want the lower bound to have PQC support. (cherry picked from commit 2c01c5b)
The previous implementation counted fpr: lines in GPG's colon output to verify that exactly one key matched the provided key ID. However, GPG emits a separate fpr: line for the primary key and each subkey, so any key with subkeys would be rejected with "There are N keys matching the key id." Count pub:/sec: lines instead, which represent actual distinct keys. Assisted-By: claude-opus-4.6 (cherry picked from commit 9d26e95)
The add-signing-service management command previously hardcoded GPG for key metadata extraction, preventing use with key types GPG cannot handle (OpenPGP v6, ML-DSA/post-quantum). This adds a --backend option that accepts "gpg" (default, existing behavior) or "sq" (Sequoia). Both backends reuse --gnupghome and --keyring, mapped to the equivalent sq CLI flags. The sq backend uses `sq cert export` to retrieve the public key and pysequoia to parse the fingerprint. Test infrastructure gains parallel Sequoia fixtures and helpers (import_signing_key_sq, make_sq_signing_script, create_signing_service_sq) and both signing service tests are parametrized to run with both backends. Assisted-By: Claude Opus 4.6 closes pulp#7479 (cherry picked from commit a66a551)
Test scenarios added: Certguard (parameterized over ML-DSA-65 and ML-DSA-87): - Download with a valid PQC client cert returns 200 - Download with an untrusted PQC client cert returns 403 - Download with no client cert returns 403 Remote sync (ML-DSA-65): - on_demand sync over HTTPS with PQC server certificate (TLS validation) - on_demand sync over HTTPS with PQC mutual TLS (client cert required) Static PQC cert/key assets and a generation script are included for both ML-DSA-65 and ML-DSA-87. Certs are generated using pycryptography's x509 builder API. Assisted-By: Claude Opus 4.6 (cherry picked from commit 03c3d76)
Post-quantum (ML-DSA) X.509 certificates are significantly larger than traditional RSA/ECDSA certificates. When a reverse proxy forwards a PQC client certificate via the X-CLIENT-CERT header, it can exceed aiohttp's default 8190-byte max_field_size, causing a 400 LineTooLong error. Increase the limit to 16KB. Assisted-By: Claude Opus 4.6 (cherry picked from commit ab9a801)
Contributor
Author
|
Hmmm, the blocker here is that 3.105 isn't using the CentOS Stream 10 CI image, and therefore doesn't have the We normally would not swap the image of an older branch, but on the other hand we want full PQC testing, and that's really the only way to do it. |
(cherry picked from commit 2d77388)
dralley
marked this pull request as ready for review
August 14, 2026 05:08
mdellweg
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.