Replace custom OpenPGP packet parsing with pysequoia by dralley · Pull Request #7433 · pulp/pulpcore

dralley · 2026-03-09T21:05:55Z

📜 Checklist

Commits are cleanly separated with meaningful messages (simple features and bug fixes should be squashed to one commit)
A changelog entry or entries has been added for any significant changes
Follows the Pulp policy on AI Usage
(For new features) - User documentation and test coverage has been added

dralley · 2026-03-09T21:18:09Z

@mdellweg @gerrod3 This is first draft quality, I have not thoroughly reviewed this. But let me know what you think, and feel free to look at the pysequoia PR as well.

I will note, that I don't think pysequoia actually supports PQC yet (the patches exist but aren't merged yet, I think RH is applying them downstream in places). So we will need to make sure that it's not doing "too much" validation

Requires wiktor-k/pysequoia#61

dralley · 2026-03-10T04:00:28Z

pulpcore/app/util.py

+        username (str): Empty string; primary UID not available without extending pysequoia.
+        data (bytes or None): The verified plaintext content for inline signatures, None for
+            detached signatures.
+    """


I'm not actually sure that we need this, but gpg_verify is public API, so I figured we would have to at least try. Unless we wait until the next breaking change release.

dralley · 2026-03-10T04:03:01Z

pyproject.toml

  "psycopg[binary]>=3.1.8,<3.4",  # SemVer, not explicitely stated, but mentioned on multiple changes.
  "pyparsing>=3.1.0,<3.4",    # Looks like only bugfixes in z-Stream.
-  "python-gnupg>=0.5.0,<0.6",  # Looks like only bugfixes in z-Stream [changelog only in git]
+  "pysequoia @ git+https://github.com/wiktor-k/pysequoia.git@refs/pull/61/head",


mdellweg · 2026-03-10T08:04:37Z

.ci/scripts/check_requirements.py

                    if "~=" in ops:
                        warnings.warn(f"{filename}:{nr}: Please avoid using ~= on {req.name}!")
-                    elif "<" not in ops and "<=" not in ops and "==" not in ops:
+                    elif "<" not in ops and "<=" not in ops and "==" not in ops and "@" not in line:


Well this check was actually intentional:
The check-commit wf fails until all the dependencies are in order again.
It should still allow the tests to run. But obviously prevent prematurely merging it.

It wasn't reaching the tests IIRC

OIC this check is in the wrong place. It should be next to "check commit messages".

I think we even document that you can do this...

mdellweg

Nice work.

mdellweg · 2026-03-10T08:15:14Z

pulpcore/app/openpgp.py

+                "raw_data": body,
+                "created": packet.signature_created,
+            }
+            # Note: Pulp's concept of "expiration time" is a duration starting at creation time


Oh it should have been expiration date?
"time" really is ambiguous.

TBF, pulp is using the terminology that was defined in the spec, so it was "correct", it's just that the terminology in the spec was ambiguous.

https://www.rfc-editor.org/rfc/rfc9580.html#name-signature-expiration-time

Opinions probably differ whether Sequoia providing expiration_time as something else is a good idea. Less ambiguous wording, but a bit confusing when it comes to the spec.

pulpcore/app/openpgp.py

mdellweg · 2026-03-10T08:32:24Z

pulpcore/app/util.py

+        if isinstance(signature, str):
+            sig_data = stack.enter_context(open(signature, "rb")).read()
+        elif isinstance(signature, models.Artifact):
+            sig_data = stack.enter_context(signature.file).read()


Admittedly, again, this is not new. But do you think we can feed this as a stream into pysequoia?

By stream do you mean read the data lazily? e.g. just passing the file handle, not a bytes buffer?

Yes, that's what i thought.
Specifically if it's an attached signature the file may be huge.

~~Probably https://docs.python.org/3/c-api/buffer.html~~

Actually, no, at least not as easily as I would hope

Why are attached signatures large? You would extract the signature for checking, surely?

In case detached_data=None we assume that signature contains the actual data (possible multiple GB) and the attached signature. And re just slurp that into memory with read.
But again, not necessarily the scope of this pr.

yeah I suppose that is a problem with the existing implementation as well. Do we have an issue filed for that?

mdellweg · 2026-03-10T08:34:06Z

pyproject.toml

  "pyparsing>=3.1.0,<3.4",    # Looks like only bugfixes in z-Stream.
-  "python-gnupg>=0.5.0,<0.6",  # Looks like only bugfixes in z-Stream [changelog only in git]
+  "pysequoia @ git+https://github.com/wiktor-k/pysequoia.git@refs/pull/61/head",
+#   "pysequoia>=0.1.32",


Are we now ready to drop the gpg dependency?

I think so, I think the remaining usage was just in tests, but it's something I would double check before marking the PR ready

So moving it to the test_requirements wouldn't even tell us we really don't use it in the application... That is sad.

The add-signing-service management command also exports keys from the system keyring using python-gnupg

I'm not entirely sure how we will get rid of that one, tbh.

Generated-By: claude-opus-4.6

Use pysequoia instead Generated-By: claude-opus-4.6

Generated-By: claude-opus-4.6

github-actions bot added multi-commit no-changelog no-issue labels Mar 9, 2026

dralley force-pushed the use-pysequoia branch 4 times, most recently from a4007d3 to ccf9278 Compare March 10, 2026 01:36

dralley changed the title ~~Use pysequoia~~ Replace custom OpenPGP packet parsing with pysequoia Mar 10, 2026

dralley commented Mar 10, 2026

View reviewed changes

mdellweg reviewed Mar 10, 2026

View reviewed changes

dralley force-pushed the use-pysequoia branch 2 times, most recently from b75892e to 56bd4a3 Compare March 11, 2026 15:09

dralley added 4 commits March 11, 2026 11:10

Replace de-novo OpenPGP parsing code with pysequoia

1e21abd

Generated-By: claude-opus-4.6

Remove python-gnupg dependency

f5bb359

Use pysequoia instead Generated-By: claude-opus-4.6

temporary dep

c0df537

Attempt to mimic the existing interface of gpg_verify()

4441274

Generated-By: claude-opus-4.6

dralley force-pushed the use-pysequoia branch from 56bd4a3 to 4441274 Compare March 11, 2026 15:16

Conversation

dralley commented Mar 9, 2026

📜 Checklist

Uh oh!

dralley commented Mar 9, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dralley Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mdellweg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dralley Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dralley Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dralley Mar 10, 2026 •

edited

Loading

dralley Mar 10, 2026 •

edited

Loading

dralley Mar 10, 2026 •

edited

Loading