Bug 2450393

Summary:	RFE: apply upstream patch to ignore channel_binding for ML-DSA
Product:	[Fedora] Fedora	Reporter:	Rob Crittenden <rcritten>
Component:	curl	Assignee:	Jan Macku <jamacku>
Status:	CLOSED DUPLICATE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	jamacku, jmigacz, kdudka, lzaoral, msekleta, paul, vmihalko
Target Milestone:	---	Keywords:	RFE
Target Release:	---
Hardware:	Unspecified
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-03-30 07:45:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Rob Crittenden 2026-03-23 17:34:53 UTC

As originally reported upstream in https://github.com/curl/curl/issues/20590

The behavior of channel binding with ML-DSA is undefined in RFC 5299. In section 4.1:

   o  if the certificate's signatureAlgorithm uses no hash functions or
      uses multiple hash functions, then this channel binding type's
      channel bindings are undefined at this time (updates to is channel
      binding type may occur to address this issue if it ever arises).

Upstream curl merged a patch to not treat this in a way to lead to connection failure. See https://github.com/curl/curl/commit/b0f6e9a3d7be02e8f2e323aa97f2ff9b30662b32

The request is to backport this to at least rawhide, if not F45 as well. This will enable development of products that use PQC and curl.

Reproducible: Always

Steps to Reproduce:
I can go into details if you need them.

Comment 1 Jan Macku 2026-03-30 07:45:32 UTC


*** This bug has been marked as a duplicate of bug 2438170 ***