Skip to content

PQC support via new pysequoia version - #8011

Open
dralley wants to merge 1 commit into
pulp:mainfrom
dralley:update-pysequoia
Open

PQC support via new pysequoia version#8011
dralley wants to merge 1 commit into
pulp:mainfrom
dralley:update-pysequoia

Conversation

@dralley

@dralley dralley commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Rebase the minimum bound of pysequoia to one which adds support for post-quantum cryptography / RFC 9980.

Add tests for gpg_verify function and PQC signing services

Assisted-By: Claude Sonnet 4.5

Comment thread pyproject.toml Outdated
"psycopg[binary]>=3.3.4,<3.4", # SemVer, not explicitely stated, but mentioned on multiple changes.
"pyparsing>=3.1.0,<3.4", # Looks like only bugfixes in z-Stream.
"pysequoia>=0.1.33,<0.2",
"pysequoia @ git+https://github.com/wiktor-k/pysequoia.git",

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's not released yet, just testing the rest of the changes.

@dralley
dralley force-pushed the update-pysequoia branch 2 times, most recently from 7bda8fc to 0d00aee Compare August 25, 2026 16:37
@dralley

dralley commented Aug 25, 2026

Copy link
Copy Markdown
Contributor Author

Using ephemeral keys turns out to be much faster than downloading keys from fixtures, 0.09s vs 5.38s. The exception is RSA which is slower (keygen is expensive by comparison to other algos) but I'm not adding any tests using RSA here.


from pulpcore.pytest_plugin import (
KEY_V4_RSA4K_PRIVATE,
KEY_V6_MLDSA65_ED25519_PRIVATE,

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, OK, we still download the fixture keys here.

@dralley dralley changed the title [do not merge] PQC support via new pysequoia version PQC support via new pysequoia version Aug 30, 2026
@dralley
dralley marked this pull request as ready for review August 30, 2026 16:27
Rebase the minimum bound of pysequoia to one which adds support for
post-quantum cryptography / RFC 9980.

Add tests for gpg_verify function and PQC signing services

Assisted-By: Claude Sonnet 4.5
]


@pytest.fixture(params=TEST_KEYS, ids=[k[0] for k in TEST_KEYS], scope="module")

@dralley dralley Aug 30, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think these tests have some value, because they do test our own API wrapper around pysequoia, but if you think they (or any individual test(s) are) more of a glorified pysequoia unit test, I can drop it.

@dralley dralley Aug 30, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Alternatively we can deprecate the gpg_verify function completely and remove it in the next breaking change release, because it's only a thin wrapper around pysequoia anyway, which plugins could just use directly if they wanted to.

@dralley
dralley requested a review from mdellweg August 30, 2026 16:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant