Update CI image + purge python-gnupg + 3.115 compatibility#1481
Open
dralley wants to merge 6 commits into
Open
Update CI image + purge python-gnupg + 3.115 compatibility#1481dralley wants to merge 6 commits into
dralley wants to merge 6 commits into
Conversation
jobselko
previously approved these changes
Jul 21, 2026
dralley
changed the title
Contributor
Author
|
python-gnupg is finicky against newer versions of GPG, and it was breaking with the CentOS Stream 10 image, so I'm just going to take this opportunity to replace it with pysequoia, which I needed to do anyway as part of the PQC work. And to get it working with 3.115 there are some small changes required. |
dralley
changed the title
dralley
commented
Jul 22, 2026
| return _deb_copy_content_domain | ||
|
|
||
|
|
||
| def import_signing_key(key_url, gpg_home): |
Contributor
Author
There was a problem hiding this comment.
This block copied straight from pulpcore. We could import from pulpcore, but I figured it's easier to just keep them independent, and we're deleting enough code that I don't feel bad about it.
dralley
force-pushed
the
centos-ci
branch
3 times, most recently
from
July 22, 2026 01:51
bc5a186 to
d3ef28c
Compare
Contributor
Author
|
@quba42 Matthias suggested I ask for your review also given the changes. Overall it's a significant simplification since sequoia doesn't require all of the ceremony that |
python-gnupg wraps the gpg binary and is sensitive to GnuPG version differences. The switch to CentOS 10 (GnuPG 2.4) broke things. Replace all runtime uses of python-gnupg with pysequoia via pulpcore's gpg_verify() helper. This has other benefits - support for newer PGP certificates and standards (including PQC) and no reliance on a system CLI tool that needs to be shelled out to and cleaned up after. - signing_service.py: remove prepare_gpg(), use gpg_verify() for all signature verification in AptReleaseSigningService and AptPackageSigningService - synchronizing.py: remove _gpg_agent_cleanup decorator and GPG instance management, use gpg_verify() directly in verify_gpg_artifacts() - signing.py: replace gpg --list-packets subprocess call with pysequoia PacketPile for extracting issuer key IDs from _gpgorigin Assisted-By: Claude Opus 4.6
Replace the signing_gpg_metadata and signing_gpg_extra fixtures with deb_signing_key_primary and deb_signing_key_secondary, which return GPGKeyInfo dataclass instances instead of gnupg.GPG objects. Copy the import_signing_key, create_signing_service, and remove_signing_service helper functions from pulpcore and use them to simplify local test fixtures Add python-gnupg to functest_requirements.txt since it is still used. Assisted-By: Claude Opus 4.6
Use find_api_root(lstrip=True) instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.