Name of Failure:

test-ocsp-ecdsa-delegate-invalid-cert-server-does-not-staple-v5.0-python3.10-min-deps on variant ocsp-rhel8 fails two tests: test_mlkem768_fails_closed and test_mlkem1024_fails_closed in test/test_ocsp_support.py.

Link to task:

https://spruce.corp.mongodb.com/task/mongo_python_driver_ocsp_rhel8_test_ocsp_ecdsa_delegate_invalid_cert_server_does_not_staple_v5.0_python3.10_min_deps_003c9cc02b6d1bb6fb7162ed9404048a20d913c7_26_09_02_20_26_52/tests?execution=0

Context of when and why the failure occurred:

Both tests call MLKEM768PrivateKey.generate() / MLKEM1024PrivateKey.generate() to build a real key. The min-deps job resolves cryptography==47.0.0 through --resolution=lowest-direct, and that build's OpenSSL does not support ML-KEM, so generate() raises before the test reaches _verify_signature's fail-closed branch.

This is a new regression, not a flake. Task history for this task and variant shows the last passing revision was 5a49944cf9 and the first failing revision was 8ce629a5af, both on 2026-08-17. 8ce629a5af is the merge of PR #2996 (PYTHON-6032), which added these two tests. Every run since has failed on every min-deps OCSP staple/does-not-staple task; 28-day reliability for this task is 2 successes out of 35 runs.

PYTHON-6032 (Closed, Fixed) added these tests to prove _verify_signature returns 0 for ML-KEM keys instead of raising AttributeError. It did not account for the min-deps cryptography build lacking ML-KEM support entirely, so the regression tests it added cannot run there.

Stack trace:

E           cryptography.exceptions.UnsupportedAlgorithm: ML-KEM-768 is not supported by this backend.
FAILED test/test_ocsp_support.py::TestVerifySignature::test_mlkem1024_fails_closed - cryptography.exceptions.UnsupportedAlgorithm: ML-KEM-1024 is not supported by this backend.
FAILED test/test_ocsp_support.py::TestVerifySignature::test_mlkem768_fails_closed - cryptography.exceptions.UnsupportedAlgorithm: ML-KEM-768 is not supported by this backend.
================ 2 failed, 60 passed, 9097 deselected in 26.89s ================