(In reply to Damien Ciabrini from comment #0)
> This bugzilla is to request the inclusion of that review downstream ahead of
> time so that auth_ed25519 can be enabled and officially supported in our
> next OpenStack RHOSP 16.1, whose beta is currently targetted for end of may.

Thanks for reporting this. While this request generally makes sense to me and we really appreciate your direct involvement in the upstream, we need to sync on expectations here, because if you meant may 2020, it is not gonna happen unfortunately.

One reason is that I'm personally not in favour of including this into RHEL before it is approved and included in the upstream. Although there might be exceptions, that is a general rule that allows RHEL to be what it is.

Once it is approved/merged upstream, it will not be available in RHEL within matter of weeks, unless there is an extra business justification to go with an z-stream release -- usually, we will aim the next y-stream RHEL release, which means months.

(In reply to Honza Horak from comment #1)
> (In reply to Damien Ciabrini from comment #0)
> > This bugzilla is to request the inclusion of that review downstream ahead of
> > time so that auth_ed25519 can be enabled and officially supported in our
> > next OpenStack RHOSP 16.1, whose beta is currently targetted for end of may.
> 
> Thanks for reporting this. While this request generally makes sense to me
> and we really appreciate your direct involvement in the upstream, we need to
> sync on expectations here, because if you meant may 2020, it is not gonna
> happen unfortunately.
>
> One reason is that I'm personally not in favour of including this into RHEL
> before it is approved and included in the upstream. Although there might be
> exceptions, that is a general rule that allows RHEL to be what it is.
> 

Understood, thanks for the explanation.

As a heads up, upstream just merged the support [1] and made a new release for it,
which has landed in rawhide [2] for what it's worth.


[1] https://github.com/PyMySQL/PyMySQL/pull/791
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1858478

Hello,

we made a plan to rebase the PyMySQL in both "python36" and "python38" module streams.
That will fulfill your request.

For more info about the rebase, check the linked BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1885641

(In reply to Honza Horak from comment #8)
> Michal, please, provide more details about this issue.

I prepared internally a testing version - rebase to the latest release.
I wrote tests for the new functionality. And when I tested the ed25519 authentication mechanism, I found out it can't be used ATM in RHEL, beacuse we don't ship package it requires.

The ed25519 functionality has been added by Damien Ciabrini <dciabrin> in a pull request the PyMySQL upstream merged.
  https://github.com/PyMySQL/PyMySQL/commit/73f977029e2c076719a7ea8d0c3df84cb44ebe7c

Damien introduced the requirement for libsodium libraries (PyNaCl package), which is necessary for the authentication mechanism to work.
The reasons why it couldn't be done any eaiser are well described here, on Damien's blog:
  https://dciabrin.net/posts/2020/09/connecting-to-mariadb-with-auth_ed25519-and-pymysql.html

TL;DR:
  The ed25519 authentication mechanism begins with 32 bytes of random data. MariaDB enhanced the ed25519 protocol, so a user password can be used, instead of the 32 random bytes.
  That caused the fact, that standard libraries and functions that already deals with ed25519 can't be re-used. And only libsodium offered convenient mathematic functions to implement the
  MariaDB way of ed25519 authentication.

---

From what I can say, I believe the ed25519 authentication mechanism is important for MariaDB users, since it is one of the most secure mechanisms.
Opposed to the default one MariaDB use, which is even discouraged for some deploy cases.
  https://mariadb.com/kb/en/authentication-plugin-mysql_native_password/
  Citation from above source:
    | It is not recommended to use the mysql_native_password authentication plugin for new installations that require high password security.
    | If someone is able to both listen to the connection protocol and get a copy of the mysql.user table, then the person would be able to use
    | this information to connect to the MariaDB server. The ed25519 authentication plugin is a more modern authentication plugin that provides
    | simple password authentication using a more secure algorithm.


Based on this, I strongly believe, the pure possibility to use ed25519 in the newer PyMySQL release is important enhancement and we should rebase to this version.

Submitted a request to update pynacl to 1.4.0 in epel8: https://src.fedoraproject.org/rpms/python-pynacl/pull-request/4

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (python36:3.6 bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:1930