Remove python-gnupg dependency

Use pysequoia instead, or shell out to gpg on the command line, which is
what python-gnupg does anyway. It's not much additional code to just
ditch the dependency everywhere.

Assisted-By: claude-opus-4.6

Author: dralley

functest_requirements.txt

@@ -1,7 +1,7 @@
 pytest<10
 pytest-custom_exit_code
 pytest-xdist
-python-gnupg
+pysequoia
 proxy.py~=2.4.10
 trustme~=1.2.1
 

pulpcore/app/management/commands/add-signing-service.py

@@ -1,6 +1,5 @@
 import os
-
-import gnupg
+import subprocess
 
 from pathlib import Path
 
@@ -72,13 +71,33 @@ def handle(self, *args, **options):
                 )
             )
 
-        gpg = gnupg.GPG(gnupghome=options["gnupghome"], keyring=options["keyring"])
+        gpg_cmd = ["gpg"]
+        if options["gnupghome"]:
+            gpg_cmd += ["--homedir", options["gnupghome"]]
+        if options["keyring"]:
+            gpg_cmd += ["--keyring", options["keyring"]]
 
-        key_list = gpg.list_keys(keys=[key_id])
-        if not len(key_list) == 1:
-            raise CommandError(_("There are {} keys matching the key id.").format(len(key_list)))
-        fingerprint = key_list[0]["fingerprint"]
-        public_key = gpg.export_keys(key_id)
+        result = subprocess.run(
+            gpg_cmd + ["--with-colons", "--fingerprint", key_id],
+            capture_output=True,
+            text=True,
+        )
+        if result.returncode != 0:
+            raise CommandError(result.stderr.strip())
+
+        fpr_lines = [line for line in result.stdout.splitlines() if line.startswith("fpr:")]
+        if len(fpr_lines) != 1:
+            raise CommandError(_("There are {} keys matching the key id.").format(len(fpr_lines)))
+        fingerprint = fpr_lines[0].split(":")[9]
+
+        result = subprocess.run(
+            gpg_cmd + ["--armor", "--export", key_id],
+            capture_output=True,
+            text=True,
+        )
+        if result.returncode != 0:
+            raise CommandError(result.stderr.strip())
+        public_key = result.stdout
 
         try:
             script_path = Path(script).resolve(strict=True)

pulpcore/app/models/openpgp.py

@@ -48,6 +48,7 @@ def represent(self, repository_version=None):
         else:
             content_filter = {}
         data = self.packet()
+        # note: because these queries aren't ordered, the result may be nondetermininistic
         for signature in self.openpgp_signatures.filter(**content_filter):
             data += signature.packet()
         for user_id in self.user_ids.filter(**content_filter):

pulpcore/app/util.py

@@ -2,14 +2,11 @@
 import zlib
 import os
 import socket
-import tempfile
 from io import RawIOBase
 from pathlib import Path
 from types import TracebackType
 from typing import Self, IO, Any
 
-import gnupg
-
 from functools import lru_cache
 from gettext import gettext as _
 from urllib.parse import urlparse
@@ -384,9 +381,45 @@ def get_request_without_query_params(context):
     return request
 
 
+class VerifyResult:
+    """
+    Verification result mimicking the interface of gnupg.Verify for compatibility.
+
+    Attributes:
+        valid (bool): Always True; invalid signatures raise InvalidSignatureError instead.
+        fingerprint (str): Fingerprint of the signing subkey (uppercase hex).
+        pubkey_fingerprint (str): Fingerprint of the signing certificate (uppercase hex).
+        key_id (str): Short (16-char) key ID derived from the fingerprint.
+        username (str): Empty string; primary UID not available without extending pysequoia.
+        data (bytes or None): The verified plaintext content for inline signatures, None for
+            detached signatures.
+    """
+
+    def __init__(self, decrypted):
+        self.valid = True
+        self.data = bytes(decrypted.bytes) if decrypted.bytes is not None else None
+        if decrypted.valid_sigs:
+            vs = decrypted.valid_sigs[0]
+            self.fingerprint = vs.signing_key.upper()
+            self.pubkey_fingerprint = vs.certificate.upper()
+            self.key_id = vs.signing_key[-16:].upper()
+            self.username = ""
+        else:
+            self.fingerprint = None
+            self.pubkey_fingerprint = None
+            self.key_id = None
+            self.username = ""
+
+    def __repr__(self):
+        return (
+            f"<VerifyResult valid={self.valid} fingerprint={self.fingerprint}"
+            f" key_id={self.key_id}>"
+        )
+
+
 def gpg_verify(public_keys, signature, detached_data=None):
     """
-    Check whether the provided gnupg signature is valid for one of the provided public keys.
+    Check whether the provided signature is valid for one of the provided public keys.
 
     Args:
         public_keys (str): Ascii armored public key data
@@ -395,25 +428,37 @@ def gpg_verify(public_keys, signature, detached_data=None):
             signature
 
     Returns:
-        gnupg.Verify: The result of the verification
+        VerifyResult: The verification result with `valid`, `fingerprint`, `pubkey_fingerprint`,
+            `key_id`, `username`, and `data` attributes, mimicking the gnupg.Verify interface.
 
     Raises:
         pulpcore.exceptions.validation.InvalidSignatureError: In case the signature is invalid.
     """
-    with tempfile.TemporaryDirectory(dir=settings.WORKING_DIRECTORY) as temp_directory_name:
-        gpg = gnupg.GPG(gnupghome=temp_directory_name)
-        gpg.import_keys(public_keys)
-
-        with ExitStack() as stack:
-            if isinstance(signature, str):
-                signature = stack.enter_context(open(signature, "rb"))
-            elif isinstance(signature, models.Artifact):
-                signature = stack.enter_context(signature.file)
-
-            verified = gpg.verify_file(signature, detached_data)
-        if not verified.valid:
-            raise InvalidSignatureError(_("The signature is not valid."), verified=verified)
-    return verified
+    from pysequoia import Cert, Sig, verify
+
+    certs = Cert.split_bytes(public_keys.encode("utf8"))
+
+    def store(key_ids):
+        return certs
+
+    with ExitStack() as stack:
+        if isinstance(signature, str):
+            sig_data = stack.enter_context(open(signature, "rb")).read()
+        elif isinstance(signature, models.Artifact):
+            sig_data = stack.enter_context(signature.file).read()
+        else:
+            sig_data = signature.read()
+
+    try:
+        sig = Sig.from_bytes(sig_data)
+        if detached_data is not None:
+            result = verify(file=detached_data, store=store, signature=sig)
+        else:
+            result = verify(bytes=sig_data, store=store)
+    except Exception:
+        raise InvalidSignatureError(_("The signature is not valid."))
+
+    return VerifyResult(result)
 
 
 def compute_file_hash(filename, hasher=None, cumulative_hash=None, blocksize=8192):

pulpcore/exceptions/validation.py

@@ -108,7 +108,7 @@ def __str__(self):
 
 class InvalidSignatureError(ValidationError):
     """
-    Raised when a signature could not be verified by the GnuPG utility.
+    Raised when a signature could not be verified.
     """
 
     error_code = "PLP0021"

pulpcore/pytest_plugin.py

@@ -1,6 +1,5 @@
 import aiohttp
 import asyncio
-import gnupg
 import json
 import os
 import pathlib
@@ -1149,22 +1148,36 @@ def signing_gpg_metadata(signing_gpg_homedir_path):
         with suppress(FileNotFoundError, PermissionError):
             key_file.write_text(private_key_data)
 
-    gpg = gnupg.GPG(gnupghome=signing_gpg_homedir_path)
-    gpg.import_keys(private_key_data)
+    from pysequoia import Cert
 
-    fingerprint = gpg.list_keys()[0]["fingerprint"]
-    keyid = gpg.list_keys()[0]["keyid"]
+    cert = Cert.from_bytes(private_key_data.encode())
+    fingerprint = cert.fingerprint.upper()
+    keyid = fingerprint[-16:]
 
-    gpg.trust_keys(fingerprint, "TRUST_ULTIMATE")
+    gpg_cmd = ["gpg", "--homedir", str(signing_gpg_homedir_path)]
+    subprocess.run(
+        gpg_cmd + ["--import"],
+        input=private_key_data,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    subprocess.run(
+        gpg_cmd + ["--import-ownertrust"],
+        input=f"{fingerprint}:6:\n",
+        capture_output=True,
+        text=True,
+        check=True,
+    )
 
-    return gpg, fingerprint, keyid
+    return cert, fingerprint, keyid
 
 
 @pytest.fixture(scope="session")
 def pulp_trusted_public_key(signing_gpg_metadata):
     """Fixture to extract the ascii armored trusted public test key."""
-    gpg, _, keyid = signing_gpg_metadata
-    return gpg.export_keys([keyid])
+    cert, _, keyid = signing_gpg_metadata
+    return str(cert)
 
 
 @pytest.fixture(scope="session")
@@ -1180,7 +1193,7 @@ def _ascii_armored_detached_signing_service_name(
     signing_gpg_homedir_path,
 ):
     service_name = str(uuid.uuid4())
-    gpg, fingerprint, keyid = signing_gpg_metadata
+    _, fingerprint, keyid = signing_gpg_metadata
 
     cmd = (
         "pulpcore-manager",

pyproject.toml

@@ -57,7 +57,6 @@ dependencies = [
   "pygtrie>=2.5,<=2.5.0",
   "psycopg[binary]>=3.1.8,<3.4",  # SemVer, not explicitely stated, but mentioned on multiple changes.
   "pyparsing>=3.1.0,<3.4",    # Looks like only bugfixes in z-Stream.
-  "python-gnupg>=0.5.0,<0.6",  # Looks like only bugfixes in z-Stream [changelog only in git]
   "pysequoia==0.1.32",
   "PyYAML>=5.1.1,<6.1",  # Looks like only bugfixes in z-Stream.
   "redis>=4.3.0,<7.2",  # Looks like only bugfixes in z-Stream.