Extend tests with PQC coverage

Assisted-By: Codex 5.6 Luna

Author: dralley

pulp_deb/tests/functional/api/test_crud_remotes.py

@@ -4,13 +4,29 @@
 from uuid import uuid4
 
 import pytest
+import requests
 
 from pulpcore.client.pulp_deb.exceptions import ApiException
+from pulpcore.pytest_plugin import KEY_V6_ED25519_PUBLIC, KEY_V6_MLDSA65_ED25519_PUBLIC
 
 from pulp_deb.tests.functional.constants import DOWNLOAD_POLICIES
 from pulp_deb.tests.functional.utils import gen_deb_remote_verbose
 
 
+@pytest.mark.parametrize("key_url", [KEY_V6_ED25519_PUBLIC, KEY_V6_MLDSA65_ED25519_PUBLIC])
+def test_create_remote_with_openpgp_gpgkey(
+    apt_remote_api, deb_remote_custom_data_factory, deb_get_fixture_server_url, key_url
+):
+    """Verify that classical and PQC OpenPGP keys can be stored on an AptRemote."""
+    key = requests.get(key_url)
+    key.raise_for_status()
+    remote = deb_remote_custom_data_factory(
+        gen_deb_remote_verbose(deb_get_fixture_server_url()) | {"gpgkey": key.text}
+    )
+
+    assert remote.gpgkey == key.text
+
+
 @pytest.fixture
 def deb_init_verbose_remote(deb_get_fixture_server_url, deb_remote_custom_data_factory):
     """A fixture that initializes are deb remote with verbose data."""

pulp_deb/tests/functional/api/test_publish.py

@@ -1,13 +1,18 @@
 import os
 import re
+import shutil
 from random import choice
 
 import pytest
+import requests
 from debian import deb822
 from django.conf import settings
 
 from pulpcore.client.pulp_deb.exceptions import ApiException
+from pulpcore.pytest_plugin import KEY_V6_MLDSA65_ED25519_PRIVATE, KEY_V6_MLDSA65_ED25519_PUBLIC
 
+from pulp_deb.app.models import AptReleaseSigningService
+from pulp_deb.tests.functional.conftest import import_signing_key
 from pulp_deb.tests.functional.constants import (
     DEB_FIXTURE_ALT_SINGLE_DIST,
     DEB_FIXTURE_ARCH,
@@ -382,6 +387,34 @@ def test_publish_signing_services(
     deb_delete_repository(repo)
 
 
+@pytest.mark.skipif(shutil.which("sq") is None, reason="Sequoia sq is required")
+def test_pqc_release_signing_service(tmp_path):
+    """Verify detached and inline Release signatures made with an ML-DSA key."""
+    public_key = requests.get(KEY_V6_MLDSA65_ED25519_PUBLIC)
+    public_key.raise_for_status()
+    home = tmp_path / "sq-home"
+    home.mkdir()
+    _, fingerprint, _ = import_signing_key(KEY_V6_MLDSA65_ED25519_PRIVATE, home, backend="sq")
+    script = tmp_path / "sign.sh"
+    script.write_text(
+        "#!/bin/sh\n"
+        f'sq --home "{home}" sign --signer {fingerprint} '
+        '--signature-file="$PULP_TEMP_WORKING_DIR/Release.gpg" "$1"\n'
+        f'sq --home "{home}" sign --signer {fingerprint} --clear-sign '
+        '--output="$PULP_TEMP_WORKING_DIR/InRelease" "$1"\n'
+        'python -c \'import json, os; print(json.dumps({"signatures": '
+        '{"detached": os.environ["PULP_TEMP_WORKING_DIR"] + "/Release.gpg", '
+        '"inline": os.environ["PULP_TEMP_WORKING_DIR"] + "/InRelease"}}))\'\n'
+    )
+    script.chmod(0o755)
+    AptReleaseSigningService(
+        name="pqc-test",
+        pubkey_fingerprint=fingerprint,
+        public_key=public_key.text,
+        script=str(script),
+    ).validate()
+
+
 @pytest.mark.parallel
 def test_publish_repository_version_verbatim(
     create_publication_and_verify_repo_version,

pulp_deb/tests/functional/conftest.py

@@ -539,29 +539,56 @@ def _deb_copy_content_domain(
     return _deb_copy_content_domain
 
 
-def import_signing_key(key_url, gpg_home):
-    """Import a PGP key into a GPG home directory and trust it.
+def import_signing_key(key_url, home, *, backend="gpg"):
+    """Import a PGP key into a keyring and return metadata.
 
-    Returns ``(gpg, fingerprint, keyid)``.
+    Returns `(gpg_instance_or_none, fingerprint, keyid)`. The first element
+    is a `gnupg.GPG` instance when `backend` is `"gpg"`, or `None` when
+    `backend` is `"sq"`.
     """
-    try:
-        import gnupg
-    except ImportError:
-        pytest.skip("python-gnupg not installed")
-
-    gpg = gnupg.GPG(gnupghome=gpg_home)
-
     response = requests.get(key_url)
     response.raise_for_status()
-    result = gpg.import_keys(response.content)
-    assert result.count >= 1, f"Failed to import key from {key_url}"
 
-    key_info = gpg.list_keys()[0]
-    fingerprint = key_info["fingerprint"]
-    keyid = key_info["keyid"]
-    gpg.trust_keys(fingerprint, "TRUST_ULTIMATE")
+    if backend == "sq":
+        from pysequoia import Cert
+
+        def openpgp_key_id(fingerprint):
+            """Return the OpenPGP key ID for a hexadecimal fingerprint.
+
+            OpenPGP v4 key IDs use the low-order 64 bits, while v6 key IDs use the
+            high-order 64 bits. The fingerprint length distinguishes these versions.
+            """
+            return (fingerprint[:16] if len(fingerprint) == 64 else fingerprint[-16:]).upper()
+
+        completed = subprocess.run(
+            ("sq", "--home", str(home), "key", "import"),
+            input=response.content,
+            capture_output=True,
+        )
+        assert completed.returncode == 0, completed.stderr.decode()
+
+        cert = Cert.from_bytes(response.content)
+        fingerprint = cert.fingerprint.upper()
+        keyid = openpgp_key_id(fingerprint)
+
+        return None, fingerprint, keyid
+    else:
+        try:
+            import gnupg
+        except ImportError:
+            pytest.skip("python-gnupg not installed")
+
+        gpg = gnupg.GPG(gnupghome=home)
+
+        result = gpg.import_keys(response.content)
+        assert result.count >= 1, f"Failed to import key from {key_url}"
+
+        key_info = gpg.list_keys()[0]
+        fingerprint = key_info["fingerprint"]
+        keyid = key_info["keyid"]
+        gpg.trust_keys(fingerprint, "TRUST_ULTIMATE")
 
-    return gpg, fingerprint, keyid
+        return gpg, fingerprint, keyid
 
 
 def create_signing_service(

pyproject.toml

@@ -28,7 +28,7 @@ requires-python = ">=3.11"
 dependencies = [
   # All things django and asyncio are deliberately left to pulpcore
   # Example transitive requirements: asgiref, asyncio, aiohttp
-  "pulpcore>=3.113.0,<3.130",
+  "pulpcore>=3.117.2,<3.130",
   "python-debian>=0.1.44,<0.2.0",
   "jsonschema>=4.6,<5.0",
 ]