Skip to content

Test use of PQC client certificates / CAs with Pulp + increase aiohttp default header size limits slightly - #7962

Merged
dralley merged 3 commits into
pulp:mainfrom
dralley:pqc-tests
Aug 12, 2026
Merged

Test use of PQC client certificates / CAs with Pulp + increase aiohttp default header size limits slightly#7962
dralley merged 3 commits into
pulp:mainfrom
dralley:pqc-tests

Conversation

@dralley

@dralley dralley commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

📜 Checklist

  • Commits are cleanly separated with meaningful messages (simple features and bug fixes should be squashed to one commit)
  • A changelog entry or entries has been added for any significant changes
  • Follows the Pulp policy on AI Usage
  • (For new features) - User documentation and test coverage has been added

See: Pull Request Walkthrough

@dralley

dralley commented Aug 11, 2026

Copy link
Copy Markdown
Contributor Author

Failure is expected due to https://redhat.atlassian.net/browse/PULP-2216

I will include a patch once I'm done refactoring the tests.

Then I believe pulp/pulp-oci-images#841 is still required in order for tests to pass.

@dralley dralley changed the title Test use of PQC client / CA certificates with Pulp Test use of PQC client certificates / CAs with Pulp Aug 11, 2026
@dralley
dralley force-pushed the pqc-tests branch 8 times, most recently from f1d0916 to 6dae71e Compare August 12, 2026 03:13
dralley
dralley commented Aug 12, 2026
View reviewed changes
Comment thread pulp_certguard/tests/functional/artifacts/x509/pqc/generate.py Outdated
dralley
dralley commented Aug 12, 2026
View reviewed changes
Comment thread pulpcore/pytest_plugin.py
@dralley

dralley commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Test run without the patch demonstrates failure with ML-DSA-87: https://github.com/pulp/pulpcore/actions/runs/31559420159/job/93998797369?pr=7962

Satellite experienced failures with ML-DSA-65, but that is because they tested with substantial entitlement metadata shoved into the certificate as an extension. We're not doing that, so ML-DSA-65 squeaks through, but ML-DSA-87 fails.

Maybe we should test putting a bit extra into the certificate to emulate entitlements?

dralley
dralley commented Aug 12, 2026
View reviewed changes
Comment thread pulp_file/tests/functional/api/test_remote_settings.py
dralley
dralley commented Aug 12, 2026
View reviewed changes
Comment thread pulp_file/pytest_plugin.py


@pytest.fixture(scope="class")
def file_remote_pqc_client_cert_req_factory(

@dralley dralley Aug 12, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is following an existing pattern, though TBH I'm not sure if it's worth creating brand new fixtures for something that gets used once and might as well be just a function call.

@dralley
dralley marked this pull request as ready for review August 12, 2026 03:48
@dralley
dralley requested a review from mdellweg August 12, 2026 03:48
@dralley dralley changed the title Test use of PQC client certificates / CAs with Pulp Test use of PQC client certificates / CAs with Pulp + increase aiohttp default header size limits slightly Aug 12, 2026
dralley
dralley commented Aug 12, 2026
View reviewed changes
Comment thread pulp_certguard/tests/functional/api/test_x509_certguard.py
mdellweg
mdellweg reviewed Aug 12, 2026
View reviewed changes
Comment thread .ci/assets/ci_constraints.txt
mdellweg
mdellweg reviewed Aug 12, 2026
View reviewed changes
Comment thread pulp_certguard/tests/functional/artifacts/x509/pqc/ML-DSA-87/keys/ca.pem Outdated
@dralley
dralley force-pushed the pqc-tests branch 2 times, most recently from 47b5b52 to f56949c Compare August 12, 2026 15:19
dralley
dralley commented Aug 12, 2026
View reviewed changes
Comment thread pulpcore/pytest_plugin.py Outdated
@dralley
dralley force-pushed the pqc-tests branch 2 times, most recently from 0d5f231 to 605e630 Compare August 12, 2026 17:23
dralley added 3 commits August 12, 2026 13:30
@dralley
Add PQC (ML-DSA) certificate test coverage
4c01743 
Test scenarios added:

Certguard (parameterized over ML-DSA-65 and ML-DSA-87):
- Download with a valid PQC client cert returns 200
- Download with an untrusted PQC client cert returns 403
- Download with no client cert returns 403

Remote sync (ML-DSA-65):
- on_demand sync over HTTPS with PQC server certificate (TLS validation)
- on_demand sync over HTTPS with PQC mutual TLS (client cert required)

Static PQC cert/key assets and a generation script are included for both
ML-DSA-65 and ML-DSA-87. Certs are generated using pycryptography's x509
builder API.

Assisted-By: Claude Opus 4.6
@dralley
Increase content app max HTTP header field size for PQC certificates
5897f93 
Post-quantum (ML-DSA) X.509 certificates are significantly larger than
traditional RSA/ECDSA certificates. When a reverse proxy forwards a
PQC client certificate via the X-CLIENT-CERT header, it can exceed
aiohttp's default 8190-byte max_field_size, causing a 400 LineTooLong
error. Increase the limit to 16KB.

Assisted-By: Claude Opus 4.6
@dralley
Bump pycryptography, pyOpenSSL versions
29e79a8 
We want the lower bound to have PQC support.
@dralley

dralley commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author 
usr/local/lib/python3.12/site-packages/pulp_certguard/tests/functional/api/test_x509_certguard.py::TestPQCX509CertGuard::test_download_with_valid_cert[ML-DSA-65] PASSED [ 72%]
usr/local/lib/python3.12/site-packages/pulp_certguard/tests/functional/api/test_x509_certguard.py::TestPQCX509CertGuard::test_download_with_untrusted_cert[ML-DSA-65] PASSED [ 77%]
usr/local/lib/python3.12/site-packages/pulp_certguard/tests/functional/api/test_x509_certguard.py::TestPQCX509CertGuard::test_download_with_no_cert[ML-DSA-65] PASSED [ 83%]
usr/local/lib/python3.12/site-packages/pulp_certguard/tests/functional/api/test_x509_certguard.py::TestPQCX509CertGuard::test_download_with_valid_cert[ML-DSA-87] PASSED [ 88%]
usr/local/lib/python3.12/site-packages/pulp_certguard/tests/functional/api/test_x509_certguard.py::TestPQCX509CertGuard::test_download_with_untrusted_cert[ML-DSA-87] PASSED [ 94%]
usr/local/lib/python3.12/site-packages/pulp_certguard/tests/functional/api/test_x509_certguard.py::TestPQCX509CertGuard::test_download_with_no_cert[ML-DSA-87] PASSED [100%]


usr/local/lib/python3.12/site-packages/pulp_file/tests/functional/api/test_remote_settings.py::test_http_sync_pqc_ssl_tls_validation_on[ML-DSA-65]
usr/local/lib/python3.12/site-packages/pulp_file/tests/functional/api/test_remote_settings.py::test_http_sync_pqc_ssl_with_client_cert_req[ML-DSA-65]
usr/local/lib/python3.12/site-packages/pulp_file/tests/functional/api/test_remote_settings.py::test_http_sync_pqc_ssl_tls_validation_on[ML-DSA-87] [gw4] [ 81%] PASSED
usr/local/lib/python3.12/site-packages/pulp_file/tests/functional/api/test_remote_settings.py::test_http_sync_pqc_ssl_tls_validation_on[ML-DSA-65] [gw3] [ 82%] PASSED
usr/local/lib/python3.12/site-packages/pulp_file/tests/functional/api/test_remote_settings.py::test_http_sync_pqc_ssl_with_client_cert_req[ML-DSA-65] [gw7] [ 84%] PASSED
usr/local/lib/python3.12/site-packages/pulp_file/tests/functional/api/test_remote_settings.py::test_http_sync_pqc_ssl_tls_validation_on[ML-DSA-87]
usr/local/lib/python3.12/site-packages/pulp_file/tests/functional/api/test_remote_settings.py::test_http_sync_pqc_ssl_with_client_cert_req[ML-DSA-87] [gw2] [ 94%] PASSED
usr/local/lib/python3.12/site-packages/pulp_file/tests/functional/api/test_remote_settings.py::test_http_sync_pqc_ssl_with_client_cert_req[ML-DSA-87]

@dralley
dralley merged commit 2c01c5b into pulp:main Aug 12, 2026
13 of 14 checks passed
@dralley
dralley deleted the pqc-tests branch August 12, 2026 18:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mdellweg mdellweg mdellweg left review comments
@ggainey ggainey ggainey approved these changes

Assignees

No one assigned

Labels

multi-commit no-changelog no-issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@dralley @ggainey @mdellweg