Bug 2376813 - merge sequoia / rpm-sequoia policy updates from rawhide to f42 and f41
Summary: merge sequoia / rpm-sequoia policy updates from rawhide to f42 and f41
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: crypto-policies
Version: 42
Hardware: Unspecified
OS: Linux
high
medium
Target Milestone: ---
Assignee: Red Hat Crypto Team
QA Contact: Fedora Extras Quality Assurance
URL: https://gitlab.com/sequoia-pgp/user-d...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-07-07 13:55 UTC by Fabio Valentini
Modified: 2025-07-13 02:58 UTC (History)
5 users (show)

Fixed In Version: crypto-policies-20250707-1.git836bbee.fc41
Clone Of:
Environment:
Last Closed: 2025-07-13 02:58:09 UTC
Type: ---
Embargoed:
fedora-admin-xmlrpc: mirror+


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FC-1777 0 None None None 2025-07-07 13:57:47 UTC

Description Fabio Valentini 2025-07-07 13:55:05 UTC
It appears that the policy updates that were done for sequoia-openpgp v2 landed only in rawhide but were not merged back to f42 or f41.

This doesn't (yet) affect rpm-sequoia since I held off with updating it to 1.8+ in stable branches for now.

But sq 1.3.0 *is* available across all branches of Fedora, so it's a bit broken with the current crypto policy.

Reproducible: Always

Comment 1 Alexander Sosedkin 2025-07-07 18:02:37 UTC
Thank you for bringing this up.

Unfortunately, crypto-policies does very much the opposite and tries to not update on stable Fedora at all, keeping a linear history.
Though there we do need backports, so I'm working on that.
Since you update stables uniformly, I'll aim to bring the configs to their current rawhide state, sans the PQ-by-default enablement.

Comment 2 Fabio Valentini 2025-07-07 18:14:22 UTC
> crypto-policies does very much the opposite and tries to not update on stable Fedora at all

I agree that this makes sense for many things. I did the same for rpm-sequoia 1.8+.

But sq 1.x were all backwards-compatible releases that didn't have user-facing breaking changes, so it made sense to update to sq 1.3 in stable branches too.

Do you know whether backporting the rpm-sequoia changes to f42 and f41 include breaking changes to the policy that would *require* updating rpm-sequoia to v1.8+? If that is the case, then *only* updating the sequoia policy might make sense instead, and we can revisit updating the rpm-sequoia policy when / if ever abolutely necessary.

Comment 3 Alexander Sosedkin 2025-07-08 07:18:54 UTC
... crypto-policies-20250707-1.gitad370a8.fc42 is my f42 take on this, will do backporting to f41 next ...

Comment 4 Alexander Sosedkin 2025-07-08 16:54:17 UTC
> Do you know whether backporting the rpm-sequoia changes to f42 and f41 include breaking changes to the policy that would *require* updating rpm-sequoia to v1.8+?

the changes
1. add algorithms and update ignore_invalid accordingly, so that should be fine
2. add a `[aead_algorithms]` section, but I think that's an old feature (2022 / sequoia-openpgp v1.11?)

Comment 5 Fedora Update System 2025-07-09 08:04:59 UTC
FEDORA-2025-a2b8a15a8b (crypto-policies-20250707-1.git836bbee.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2025-a2b8a15a8b

Comment 6 Fabio Valentini 2025-07-09 13:11:13 UTC
Thank you - makes sense to me!

Comment 7 Fedora Update System 2025-07-10 18:45:49 UTC
FEDORA-2025-a2b8a15a8b has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-a2b8a15a8b`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-a2b8a15a8b

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 8 Fedora Update System 2025-07-13 02:58:09 UTC
FEDORA-2025-a2b8a15a8b (crypto-policies-20250707-1.git836bbee.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.