Replace custom OpenPGP packet parsing with pysequoia by dralley · Pull Request #7433 · pulp/pulpcore

dralley · 2026-03-09T21:05:55Z

📜 Checklist

Commits are cleanly separated with meaningful messages (simple features and bug fixes should be squashed to one commit)
A changelog entry or entries has been added for any significant changes
Follows the Pulp policy on AI Usage
(For new features) - User documentation and test coverage has been added

dralley · 2026-03-09T21:18:09Z

@mdellweg @gerrod3 This is first draft quality, I have not thoroughly reviewed this. But let me know what you think, and feel free to look at the pysequoia PR as well.

I will note, that I don't think pysequoia actually supports PQC yet (the patches exist but aren't merged yet, I think RH is applying them downstream in places). So we will need to make sure that it's not doing "too much" validation

Requires wiktor-k/pysequoia#61

dralley · 2026-03-10T04:00:28Z

pulpcore/app/util.py

+        username (str): Empty string; primary UID not available without extending pysequoia.
+        data (bytes or None): The verified plaintext content for inline signatures, None for
+            detached signatures.
+    """


I'm not actually sure that we need this, but gpg_verify is public API, so I figured we would have to at least try. Unless we wait until the next breaking change release.

pulp_ansible seems to use the result in a trivial way, we could delete most of this at the next breaking change release.

pyproject.toml

.ci/scripts/check_requirements.py

mdellweg

Nice work.

mdellweg · 2026-03-10T08:15:14Z

pulpcore/app/openpgp.py

+                "raw_data": body,
+                "created": packet.signature_created,
+            }
+            # Note: Pulp's concept of "expiration time" is a duration starting at creation time


Oh it should have been expiration date?
"time" really is ambiguous.

TBF, pulp is using the terminology that was defined in the spec, so it was "correct", it's just that the terminology in the spec was ambiguous.

https://www.rfc-editor.org/rfc/rfc9580.html#name-signature-expiration-time

Opinions probably differ whether Sequoia providing expiration_time as something else is a good idea. Less ambiguous wording, but a bit confusing when it comes to the spec.

pulpcore/app/openpgp.py

pulpcore/app/util.py

pyproject.toml

Generated-By: claude-opus-4.6

mdellweg · 2026-04-07T09:18:45Z

functest_requirements.txt

 pytest-custom_exit_code
 pytest-xdist
-python-gnupg
+pysequoia


Why are we even repeating the dependency here? (It's not optional in pyproject, right?)

functional tests can run outside the environment where Pulp is installed.

mdellweg · 2026-04-07T09:21:26Z

pulpcore/pytest_plugin.py

-    return gpg, fingerprint, keyid
+    return cert, fingerprint, keyid


Is anything outside of pulpcore using this fixture?

Looks like yes https://github.com/search?q=org%3Apulp%20signing_gpg_metadata&type=code

pulp_container and pulp_deb at least, pulp_rpm looks like it might have a copy of an identical name

mdellweg · 2026-04-07T09:22:18Z

pulpcore/pytest_plugin.py

+    keyid = fingerprint[-16:]

-    gpg.trust_keys(fingerprint, "TRUST_ULTIMATE")
+    gpg_cmd = ["gpg", "--homedir", str(signing_gpg_homedir_path)]


Is this now using sequoia too, depending on the actual binary installed?

It's using whichever utility is behind the command named gpg, which AFAIK is still just gpg. I don't think RHEL 10 is using a replacement under the gpg name

mdellweg · 2026-04-07T09:26:41Z

pulpcore/app/util.py

+            self.pubkey_fingerprint = vs.certificate.upper()
+            self.key_id = vs.signing_key[-16:].upper()
+            self.username = ""
+        else:


What does this branch mean? Can a signature be valid when there are no signatures at all?

I believe you are correct, it's dead code. Removed

mdellweg · 2026-04-07T09:31:43Z

pulpcore/app/management/commands/add-signing-service.py

            )

-        gpg = gnupg.GPG(gnupghome=options["gnupghome"], keyring=options["keyring"])
+        gpg_cmd = ["gpg"]


Wouldn't we need this to use sequoia too in order to handle all the new algorithms and keyfile formats?

Even sequoia doesn't "support" them yet because the IETF draft isn't final yet. You have to install a special build to get them. So it's out of scope for now. At some point, probably, but even then it might be a host-dependent thing.

Use pysequoia instead, or shell out to gpg on the command line, which is what python-gnupg does anyway. It's not much additional code to just ditch the dependency everywhere. Assisted-By: claude-opus-4.6

github-actions bot added multi-commit no-changelog no-issue labels Mar 9, 2026

dralley force-pushed the use-pysequoia branch 4 times, most recently from a4007d3 to ccf9278 Compare March 10, 2026 01:36

dralley changed the title ~~Use pysequoia~~ Replace custom OpenPGP packet parsing with pysequoia Mar 10, 2026

dralley commented Mar 10, 2026

View reviewed changes

pyproject.toml Outdated Show resolved Hide resolved

mdellweg reviewed Mar 10, 2026

View reviewed changes

.ci/scripts/check_requirements.py Outdated Show resolved Hide resolved

mdellweg reviewed Mar 10, 2026

View reviewed changes

dralley force-pushed the use-pysequoia branch 3 times, most recently from 56bd4a3 to 4441274 Compare March 11, 2026 15:16

dralley force-pushed the use-pysequoia branch from 4441274 to 49e2631 Compare March 18, 2026 18:38

dralley force-pushed the use-pysequoia branch 2 times, most recently from 38ee7d1 to a234584 Compare April 4, 2026 17:22

Replace de-novo OpenPGP parsing code with pysequoia

829fd36

Generated-By: claude-opus-4.6

dralley force-pushed the use-pysequoia branch 2 times, most recently from e232d0d to 9827fcc Compare April 4, 2026 17:46

dralley marked this pull request as ready for review April 4, 2026 18:43

dralley requested a review from mdellweg April 4, 2026 18:43

mdellweg reviewed Apr 7, 2026

View reviewed changes

Remove python-gnupg dependency

1d855c0

Use pysequoia instead, or shell out to gpg on the command line, which is what python-gnupg does anyway. It's not much additional code to just ditch the dependency everywhere. Assisted-By: claude-opus-4.6

dralley force-pushed the use-pysequoia branch from 9827fcc to 1d855c0 Compare April 7, 2026 14:59

		return gpg, fingerprint, keyid
		return cert, fingerprint, keyid

Conversation

dralley commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📜 Checklist

Uh oh!

dralley commented Mar 9, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

mdellweg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dralley Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dralley commented Mar 9, 2026 •

edited

Loading

dralley Apr 7, 2026 •

edited

Loading