Replace custom OpenPGP packet parsing with pysequoia by dralley · Pull Request #7433 · pulp/pulpcore

dralley · 2026-03-09T21:05:55Z

📜 Checklist

Commits are cleanly separated with meaningful messages (simple features and bug fixes should be squashed to one commit)
A changelog entry or entries has been added for any significant changes
Follows the Pulp policy on AI Usage
(For new features) - User documentation and test coverage has been added

dralley · 2026-03-09T21:18:09Z

@mdellweg @gerrod3 This is first draft quality, I have not thoroughly reviewed this. But let me know what you think, and feel free to look at the pysequoia PR as well.

I will note, that I don't think pysequoia actually supports PQC yet (the patches exist but aren't merged yet, I think RH is applying them downstream in places). So we will need to make sure that it's not doing "too much" validation

Requires wiktor-k/pysequoia#61

pulpcore/app/util.py

pyproject.toml

.ci/scripts/check_requirements.py

mdellweg

Nice work.

mdellweg · 2026-03-10T08:15:14Z

pulpcore/app/openpgp.py

+                "raw_data": body,
+                "created": packet.signature_created,
+            }
+            # Note: Pulp's concept of "expiration time" is a duration starting at creation time


Oh it should have been expiration date?
"time" really is ambiguous.

TBF, pulp is using the terminology that was defined in the spec, so it was "correct", it's just that the terminology in the spec was ambiguous.

https://www.rfc-editor.org/rfc/rfc9580.html#name-signature-expiration-time

Opinions probably differ whether Sequoia providing expiration_time as something else is a good idea. Less ambiguous wording, but a bit confusing when it comes to the spec.

pulpcore/app/openpgp.py

pulpcore/app/util.py

pyproject.toml

Generated-By: claude-opus-4.6

functest_requirements.txt

mdellweg · 2026-04-07T09:21:26Z

pulpcore/pytest_plugin.py

-    return gpg, fingerprint, keyid
+    return cert, fingerprint, keyid


Is anything outside of pulpcore using this fixture?

Looks like yes https://github.com/search?q=org%3Apulp%20signing_gpg_metadata&type=code

pulp_container and pulp_deb at least, pulp_rpm looks like it might have a copy of an identical name

Looks like pulp_deb's use is only interested in the third argument (keyid).
But Container uses the gpghome from the first one you change. We need to address that first I think.

I updated with another compatibility shim.

mdellweg · 2026-04-07T09:22:18Z

pulpcore/pytest_plugin.py

+    keyid = fingerprint[-16:]

-    gpg.trust_keys(fingerprint, "TRUST_ULTIMATE")
+    gpg_cmd = ["gpg", "--homedir", str(signing_gpg_homedir_path)]


Is this now using sequoia too, depending on the actual binary installed?

It's using whichever utility is behind the command named gpg, which AFAIK is still just gpg. I don't think RHEL 10 is using a replacement under the gpg name

mdellweg · 2026-04-07T09:26:41Z

pulpcore/app/util.py

+            self.pubkey_fingerprint = vs.certificate.upper()
+            self.key_id = vs.signing_key[-16:].upper()
+            self.username = ""
+        else:


What does this branch mean? Can a signature be valid when there are no signatures at all?

I believe you are correct, it's dead code. Removed

mdellweg · 2026-04-07T09:31:43Z

pulpcore/app/management/commands/add-signing-service.py

            )

-        gpg = gnupg.GPG(gnupghome=options["gnupghome"], keyring=options["keyring"])
+        gpg_cmd = ["gpg"]


Wouldn't we need this to use sequoia too in order to handle all the new algorithms and keyfile formats?

Even sequoia doesn't "support" them yet because the IETF draft isn't final yet. You have to install a special build to get them. So it's out of scope for now. At some point, probably, but even then it might be a host-dependent thing.

mdellweg

One last suggestion.
You can also ignore...

pulpcore/pytest_plugin.py

pyproject.toml

Use pysequoia instead, or shell out to gpg on the command line, which is what python-gnupg does anyway. It's not much additional code to just ditch the dependency everywhere. Assisted-By: claude-opus-4.6

github-actions bot added multi-commit no-changelog no-issue labels Mar 9, 2026

dralley force-pushed the use-pysequoia branch 4 times, most recently from a4007d3 to ccf9278 Compare March 10, 2026 01:36

dralley changed the title ~~Use pysequoia~~ Replace custom OpenPGP packet parsing with pysequoia Mar 10, 2026

dralley commented Mar 10, 2026

View reviewed changes

pulpcore/app/util.py Show resolved Hide resolved

dralley commented Mar 10, 2026

View reviewed changes

pyproject.toml Outdated Show resolved Hide resolved

mdellweg reviewed Mar 10, 2026

View reviewed changes

.ci/scripts/check_requirements.py Outdated Show resolved Hide resolved

mdellweg reviewed Mar 10, 2026

View reviewed changes

dralley force-pushed the use-pysequoia branch 3 times, most recently from 56bd4a3 to 4441274 Compare March 11, 2026 15:16

dralley force-pushed the use-pysequoia branch from 4441274 to 49e2631 Compare March 18, 2026 18:38

dralley force-pushed the use-pysequoia branch 2 times, most recently from 38ee7d1 to a234584 Compare April 4, 2026 17:22

Replace de-novo OpenPGP parsing code with pysequoia

829fd36

Generated-By: claude-opus-4.6

dralley force-pushed the use-pysequoia branch 2 times, most recently from e232d0d to 9827fcc Compare April 4, 2026 17:46

dralley marked this pull request as ready for review April 4, 2026 18:43

dralley requested a review from mdellweg April 4, 2026 18:43

mdellweg reviewed Apr 7, 2026

View reviewed changes

dralley force-pushed the use-pysequoia branch 2 times, most recently from 1d855c0 to 731c4ce Compare April 8, 2026 13:44

dralley enabled auto-merge (rebase) April 8, 2026 15:08

mdellweg reviewed Apr 9, 2026

View reviewed changes

pulpcore/pytest_plugin.py Show resolved Hide resolved

pyproject.toml Outdated Show resolved Hide resolved

Remove python-gnupg dependency

e693339

Use pysequoia instead, or shell out to gpg on the command line, which is what python-gnupg does anyway. It's not much additional code to just ditch the dependency everywhere. Assisted-By: claude-opus-4.6

dralley force-pushed the use-pysequoia branch from 731c4ce to e693339 Compare April 9, 2026 12:35

mdellweg approved these changes Apr 9, 2026

View reviewed changes

dralley merged commit bc6396a into pulp:main Apr 9, 2026
13 of 14 checks passed

dralley deleted the use-pysequoia branch April 9, 2026 13:09

		return gpg, fingerprint, keyid
		return cert, fingerprint, keyid

Conversation

dralley commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📜 Checklist

Uh oh!

dralley commented Mar 9, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mdellweg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dralley Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mdellweg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dralley commented Mar 9, 2026 •

edited

Loading

dralley Apr 7, 2026 •

edited

Loading