Improve post-quantum signature test coverage by dralley · Pull Request #4542 · pulp/pulp_rpm

dralley · 2026-08-05T19:02:10Z

Add tests for ML-DSA signed RPM packages across upload, sync, and signing service paths.

Extend RepositoryBuilder with an option to build real packages from metadata, and build_from_files() for creating repos with existing RPMs.

New tests:

Upload with ML-DSA87+Ed448 key
Upload pre-built multi-signed fixture (v4 RSA + v6 ML-DSA87)
signing_key filter API with v6 fingerprints
Sync of ML-DSA signed packages

Assisted-By: Claude Opus 4.6

dralley · 2026-08-05T19:05:17Z

+        self,
+        packages: list[MetaPackage],
+        base_path: Optional[str] = None,
+        real_packages: bool = False,


The PR doesn't actually use this option, I just thought it would be cool to add.

Agreed, nice addition :)

dralley · 2026-08-05T19:09:17Z

+    rpm_path.write_bytes(requests.get(RPM_UNSIGNED_URL).content)
+
+    # TODO: generate a new PQC key in-place to make it truly unique, avoid conflicts with other tests
+    _sign_package(rpm_path, KEY_V6_MLDSA65_ED25519.private_url)


Can't do this until my PySequoia PR merges and is released.

dralley · 2026-08-06T02:48:11Z

Note: this is ready for review now, but isn't ready to merge yet, since I'm writing tests that rely on pulp/pulpcore#7946

Also relies on wiktor-k/pysequoia#84

dralley · 2026-08-18T20:57:10Z

Some more fun notes:

It's much faster to generate a package using rpm_rs than it is to download from fixtures.pulpproject.org, about 28 milliseconds vs 220
It's much faster to generate an ed25519 or ML-DSA signing key locally than it is to download from fixtures.pulpproject.org / github, single-digit milliseconds vs 100+ms. Not so with RSA keys which are expensive to generate.

pedro-psb · 2026-08-21T15:34:19Z

+                raise RuntimeError("Server does not have domains enabled.")
+            kwargs["pulp_domain"] = pulp_domain
+
+        return gen_object_with_cleanup(rpm_package_api, **upload_attrs, **kwargs)


Any reason do not keep cleaning up the temporary files here? (as with NamedTemporaryFile did).
It's already uploaded to Pulp's storage and apparently we don't ever need that tmp file again.

I don't think so

It probably happened just because we gave the temp file a name.

pedro-psb · 2026-08-21T17:54:43Z

+                strict=True,
+                reason="add-signing-service uses GPG internally,"
+                " which cannot handle ML-DSA / v6 keys",
+            ),


Let's see if I get it.
pulpcore has merged this PR adding support for pysquoia, but the pqc support was just merged into pysequoia now. So once pulpcore requires the appropriate pysequoia version Pulp will be able to handle PQC signing services. Is that right? If yes, will this PR wait for the chain of events to finish?

Essentially, yes.

pedro-psb · 2026-08-21T18:24:26Z

+        self,
+        packages: list[MetaPackage],
+        base_path: Optional[str] = None,
+        real_packages: bool = False,


Agreed, nice addition :)

pedro-psb · 2026-08-21T18:46:20Z

+    nevra = Nevra(name="upload-signed-test", epoch=0, version="1.0", release="1", arch="noarch")
+    rpm_path = tmp_path / f"{nevra.to_nvra()}.rpm"
+    build_rpm(nevra, rpm_path)
+    _sign_package(rpm_path, KEY_V4_RSA4K.private_url)


pedro-psb · 2026-08-21T18:50:06Z

+    Verifies that signing_keys contains both v4 and v6 prefixed fingerprints.
+    """
+    rpm_path = tmp_path / "multi-signed.rpm"
+    rpm_path.write_bytes(requests.get(RPM_FIXTURE_MULTI_SIGNED).content)


Could we also multi-sign on the fly? Just curious

We definitely could but we do probably want to use rpmbuild-built packages in at least some tests and I figured this was an important enough case to do so.

pedro-psb · 2026-08-21T18:55:07Z

+    assert synced_package.version == nevra.version
+
+    # signing_keys is None after sync (known limitation, see synchronizing.py:1470-1471)
+    assert synced_package.signing_keys is None


pedro-psb · 2026-08-21T19:03:38Z

+def pqc_package_signing_service(tmp_path, has_rpmv6_support, pulpcore_bindings):
+    """Create a PQC (ML-DSA) package signing service using Sequoia."""
+    if not has_rpmv6_support:
+        pytest.skip("rpmsign --rpmv6 not available")


Is there a legit environment we expect this to not be available? If there isn't, I would prefer this to be an assert than a skip.
I assume the rpm v6 is provided in centos stream 10, which is well established now, right? At least on the branches where we are need PQC support.

RHEL 9 / CS9

Add tests for ML-DSA signed RPM packages across upload, sync, and signing service paths. Extend RepositoryBuilder with an option to build real packages from metadata, and build_from_files() for creating repos with existing RPMs. New tests: - Upload with ML-DSA87+Ed448 key - Upload pre-built multi-signed fixture (v4 RSA + v6 ML-DSA87) - signing_key filter API with v6 fingerprints - Sync of ML-DSA signed packages (documents signing_keys=None limitation) - Using a signing service with ML-DSA keys for package signing (xfail) - Using a signing service with ML-DSA keys for metadata signing (xfail) Assisted-By: Claude Opus 4.6

The pattern we were using did not consistently raise errors on 404

Use rpm-rs to build (and optionally sign) RPMs in the test suite rather than downloading fixture packages. Local generation is faster and lets tests use unique per-test packages, so many upload/signing tests no longer need delete_orphans_pre and can run in parallel. - build_rpm() gains an optional signer to produce signed packages - rpm_package_factory/rpm_artifact_factory default to local generation - drop now-unused fixtures/constants (signed_artifact, LEGACY_SIGNING_KEY, RPM_*_URL2, RPM_PACKAGE_FILENAME2) - downloading key assets is avoided where possible Assisted-By: Claude Opus 4.8

Fetch each public/private signing-key file once per session instead of once per test, and parameterize the signer and verifier fixtures over any FixtureKey via rpm_signer_factory and rpm_verifier_factory. Assisted-By: Claude Opus 4.8

Assisted-By: Claude Opus 4.6

Override rpm's gpg signing command (%__gpg_sign_cmd) with a shim that shells out to `sq`, which works on both old and new rpm. Also fix the script's JSON output quoting and assert the signing subkey fingerprint (signatures are issued by the subkey, not the primary key). Assisted-By: Claude Opus 4.8

github-actions Bot added no-changelog no-issue labels Aug 5, 2026

dralley force-pushed the pqc-coverage branch 2 times, most recently from 69f63b1 to 086057b Compare August 5, 2026 19:04

dralley commented Aug 5, 2026

View reviewed changes

dralley force-pushed the pqc-coverage branch 3 times, most recently from fbf4bfd to c39bed2 Compare August 6, 2026 01:51

github-actions Bot added the multi-commit Added when a PR consists of more than one commit label Aug 6, 2026

dralley force-pushed the pqc-coverage branch from 6807b72 to 3b03b9d Compare August 6, 2026 02:22

dralley marked this pull request as draft August 6, 2026 02:43

dralley force-pushed the pqc-coverage branch from 0bbdfaa to a2900d3 Compare August 6, 2026 02:48

dralley force-pushed the pqc-coverage branch from a2900d3 to 76e134e Compare August 6, 2026 03:28

github-actions Bot removed the multi-commit Added when a PR consists of more than one commit label Aug 6, 2026

ggainey mentioned this pull request Aug 7, 2026

Fix IntegrityError on multi-source copy with dependency solving #4468

Open

4 tasks

dralley force-pushed the pqc-coverage branch from 76e134e to 592880f Compare August 18, 2026 20:33

github-actions Bot added the multi-commit Added when a PR consists of more than one commit label Aug 18, 2026

dralley force-pushed the pqc-coverage branch 2 times, most recently from 0fb5071 to d5fdba0 Compare August 19, 2026 01:40

pedro-psb reviewed Aug 21, 2026

View reviewed changes

dralley force-pushed the pqc-coverage branch 2 times, most recently from 2d2d92e to cdbf164 Compare August 31, 2026 16:33

dralley added 2 commits September 1, 2026 09:00

Use fetch_url helper for downloads

e32df68

The pattern we were using did not consistently raise errors on 404

dralley force-pushed the pqc-coverage branch from cdbf164 to e8abe52 Compare September 1, 2026 16:46

dralley marked this pull request as ready for review September 1, 2026 16:53

dralley requested a review from pedro-psb September 1, 2026 16:54

dralley force-pushed the pqc-coverage branch 2 times, most recently from b6995c0 to 5659db9 Compare September 1, 2026 17:42

dralley added 3 commits September 1, 2026 17:17

Enable PQC related tests that require pulpcore support

c1c68ac

Assisted-By: Claude Opus 4.6

dralley force-pushed the pqc-coverage branch 3 times, most recently from 430db08 to 509e932 Compare September 2, 2026 01:51

dralley force-pushed the pqc-coverage branch from 509e932 to f32a693 Compare September 2, 2026 01:54

Uh oh!

Conversation

dralley commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dralley commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dralley commented Aug 18, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dralley Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dralley commented Aug 5, 2026 •

edited

Loading

dralley commented Aug 6, 2026 •

edited

Loading

dralley Aug 21, 2026 •

edited

Loading