feat: POC of PQC negotiation with candlepin server#3713
Draft
jirihnidek wants to merge 2 commits intomainfrom
Draft
feat: POC of PQC negotiation with candlepin server#3713jirihnidek wants to merge 2 commits intomainfrom
jirihnidek wants to merge 2 commits intomainfrom
Conversation
Reviewer's GuideImplements client-side PQC negotiation by adding a configurable certificate_signatures mode, wiring supported public key algorithms into the consumer registration request, updating defaults and rhsm.conf, and fixing impacted tests plus a flaky file monitor assertion. Sequence diagram for PQC-aware consumer registrationsequenceDiagram
actor User
participant SubscriptionManager as RhsmlibServicesRegister
participant Config as RhsmConfig
participant PQC as SubscriptionManagerPqc
participant Conn as RhsmConnection
participant Candlepin as CandlepinServer
User->>SubscriptionManager: register(options)
SubscriptionManager->>Config: get_config_parser()
Config-->>SubscriptionManager: config
SubscriptionManager->>Config: get rhsm.certificate_signatures
Config-->>SubscriptionManager: certificate_signatures
alt certificate_signatures == current
SubscriptionManager->>PQC: get_public_key_algorithms()
PQC-->>SubscriptionManager: crypto_algorithms: List[str]
else certificate_signatures == legacy
SubscriptionManager->>SubscriptionManager: Use legacy certificate algorithms
Note over SubscriptionManager: crypto_algorithms = None
else unknown value
SubscriptionManager->>SubscriptionManager: Log warning
Note over SubscriptionManager: crypto_algorithms = None
end
SubscriptionManager->>Conn: registerConsumer(..., crypto_algorithms)
Conn->>Conn: Build headers and params
alt crypto_algorithms is not None
Conn->>Conn: params[cryptographicAlgorithms] = crypto_algorithms
end
Conn->>Candlepin: POST /consumers
Candlepin-->>Conn: Consumer JSON
Conn-->>SubscriptionManager: Consumer JSON
SubscriptionManager-->>User: Registration result
Class diagram for PQC negotiation and configuration changesclassDiagram
class RhsmlibServicesRegister {
+register(options)
}
class RhsmConnection {
+registerConsumer(name, type, facts, hostname, uuid, organization, environment, service_level, usage, jwt_token, crypto_algorithms: List~str~)
}
class SubscriptionManagerPqc {
+run(cmd, shell, cwd)
+get_public_key_algorithms()
+__smoke_test__()
}
class RhsmConfigDefaults {
+RHSM_DEFAULTS
+certificate_signatures = "legacy"
}
class RhsmConfFile {
+certificate_signatures = current
}
RhsmlibServicesRegister --> RhsmConfigDefaults : reads_defaults
RhsmlibServicesRegister --> RhsmConfFile : reads_runtime_value
RhsmlibServicesRegister --> SubscriptionManagerPqc : uses_get_public_key_algorithms
RhsmlibServicesRegister --> RhsmConnection : calls_registerConsumer
RhsmConnection --> CandlepinServer : POST_consumers
class CandlepinServer {
+createConsumer(cryptographicAlgorithms: List~str~)
}
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
Author
|
It adds following to the body of HTTP request on Fedora 43: "cryptographicAlgorithms": [
"1.2.840.113549.1.1.1",
"1.2.840.113549.1.3.1",
"1.2.840.10040.4.1",
"1.2.840.10045.2.1",
"1.2.840.113549.1.1.10",
"1.2.840.10046.2.1",
"1.3.101.110",
"1.3.101.111",
"1.3.101.112",
"1.3.101.113",
"2.16.840.1.101.3.4.3.17",
"2.16.840.1.101.3.4.3.18",
"2.16.840.1.101.3.4.3.19",
"1.3.6.1.4.1.11591.4.11",
"2.16.840.1.101.3.4.4.1",
"2.16.840.1.101.3.4.4.2",
"2.16.840.1.101.3.4.4.3",
"2.16.840.1.101.3.4.3.20",
"2.16.840.1.101.3.4.3.21",
"2.16.840.1.101.3.4.3.22",
"2.16.840.1.101.3.4.3.23",
"2.16.840.1.101.3.4.3.24",
"2.16.840.1.101.3.4.3.25",
"2.16.840.1.101.3.4.3.26",
"2.16.840.1.101.3.4.3.27",
"2.16.840.1.101.3.4.3.28",
"2.16.840.1.101.3.4.3.29",
"2.16.840.1.101.3.4.3.30",
"2.16.840.1.101.3.4.3.31"
] |
jirihnidek
force-pushed
the
jhnidek/pqc_poc
branch
from
5cdcbd3 to
9841806
Compare
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
m-horky
requested changes
Mar 2, 2026
Contributor
m-horky
left a comment
m-horky
left a comment
There was a problem hiding this comment.
Overall I like the patch. I left a few notes.
Contributor
There was a problem hiding this comment.
This feels unrelated, could you move it to a separate commit? I know you are mentioning it in the git message, but I'd like to make it explicit it is not related to PQC.
Contributor
Author
There was a problem hiding this comment.
Sure, this is only POC. I will do it better in real PR.
jirihnidek
force-pushed
the
jhnidek/pqc_poc
branch
from
9841806 to
6cf8800
Compare
Contributor
Author
|
I really did not ask for closing this PR! |
Contributor
Author
|
I did not want to close the PR. |
Contributor
Author
|
I want to re-open this PR. |
Comment on lines
+15
to
+23
| proc = subprocess.Popen( | ||
| cmd, | ||
| shell=shell, | ||
| cwd=cwd, | ||
| stdout=subprocess.PIPE, | ||
| stderr=subprocess.PIPE, | ||
| universal_newlines=True, | ||
| errors="surrogateescape", | ||
| ) |
There was a problem hiding this comment.
security (python.lang.security.audit.dangerous-subprocess-use-audit): Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'.
Source: opengrep
Contributor
Author
|
When union of public key an signature algorithms is used, then the list is little bit longer: "cryptographicAlgorithms": [
"2.16.840.1.101.3.4.3.9",
"2.16.840.1.101.3.4.3.30",
"2.16.840.1.101.3.4.4.2",
"1.2.840.10045.4.3.2",
"2.16.840.1.101.3.4.3.28",
"1.2.840.113549.1.1.5",
"1.2.840.113549.1.3.1",
"2.16.840.1.101.3.4.3.29",
"2.16.840.1.101.3.4.3.15",
"2.16.840.1.101.3.4.3.18",
"1.2.840.113549.1.1.16",
"2.16.840.1.101.3.4.3.20",
"1.3.36.3.3.1.2",
"2.16.840.1.101.3.4.3.1",
"2.16.840.1.101.3.4.3.19",
"2.16.840.1.101.3.4.4.1",
"1.2.840.10040.4.1",
"1.2.840.10045.4.3.4",
"1.2.840.113549.1.1.1",
"1.2.840.113549.1.1.13",
"1.2.840.1.101.3.4.3.3",
"2.16.840.1.101.3.4.3.25",
"1.3.101.110",
"2.16.840.1.101.3.4.3.23",
"1.2.840.113549.1.1.11",
"1.2.840.10040.4.3",
"1.2.840.1.101.3.4.3.4",
"2.16.840.1.101.3.4.3.5",
"2.16.840.1.101.3.4.4.3",
"1.2.840.10045.2.1",
"1.2.840.113549.1.1.14",
"1.3.6.1.4.1.11591.4.11",
"2.16.840.1.101.3.4.3.22",
"1.2.840.113549.1.1.15",
"2.16.840.1.101.3.4.3.2",
"1.2.840.10045.4.3.1",
"1.3.101.113",
"2.16.840.1.101.3.4.3.26",
"2.16.840.1.101.3.4.3.10",
"2.16.840.1.101.3.4.3.27",
"2.16.840.1.101.3.4.3.14",
"1.2.840.113549.1.1.10",
"2.16.840.1.101.3.4.3.24",
"1.2.156.10197.1.504",
"2.16.840.1.101.3.4.3.12",
"2.16.840.1.101.3.4.3.16",
"2.16.840.1.101.3.4.3.11",
"1.2.840.10045.4.1",
"1.2.840.10046.2.1",
"2.16.840.1.101.3.4.3.8",
"1.2.840.10045.4.3.3",
"2.16.840.1.101.3.4.3.17",
"1.3.101.112",
"2.16.840.1.101.3.4.3.13",
"2.16.840.1.101.3.4.3.6",
"1.3.101.111",
"2.16.840.1.101.3.4.3.31",
"1.2.840.113549.1.1.12",
"2.16.840.1.101.3.4.3.7",
"2.16.840.1.101.3.4.3.21"
] |
* Added new method for getting signature algorithms * Added method for getting union of public key algorithms and signature algorithms * The regular expressions are used for getting IODs from openssl output Signed-off-by: Jiri Hnidek <[email protected]>
jirihnidek
force-pushed
the
jhnidek/pqc_poc
branch
from
732493a to
6321063
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
certificate_signatures. It can have two possible options:"legacy"and"current". Default value is"legacy". When an user set the value to"current", then it opts-in using PQC for consumer and entitlement certificates and thus related connections.certificate_signaturesoption is set, then client (subscription-managerorrhsm.service) adds the list of supported public key algorithms to the JSON object that is sent during "register" (POST /consumers?owner=$OWNER)