gh-158285: Deprecate socket.ALG_SET_PUBKEY, ALG_OP_SIGN and ALG_OP_VERIFY

They are libkcapi's own values and were never defined by the Linux
kernel, which uses the value of ALG_SET_PUBKEY for ALG_SET_DRBG_ENTROPY.
socket no longer re-exports them from _socket, and accessing them through
socket emits a DeprecationWarning. Removal is slated for 3.21.

Author: MannXo

Doc/deprecations/pending-removal-in-3.21.rst

@@ -18,6 +18,11 @@ Pending removal in Python 3.21
   * The ``dims`` property of ``ast.Tuple`` will be removed in Python 3.21. Use
     the ``ast.Tuple.elts`` property instead.
 
+* :mod:`socket`:
+
+  * ``ALG_SET_PUBKEY``, ``ALG_OP_SIGN`` and ``ALG_OP_VERIFY`` will be removed
+    in Python 3.21.  They were never defined by the Linux kernel.
+
 * :mod:`struct`:
 
   * Soft-deprecated since Python 3.15, using ``'F'`` and ``'D'`` type codes are now

Doc/library/socket.rst

@@ -637,6 +637,11 @@ The AF_* and SOCK_* constants are now :class:`AddressFamily` and
 
    .. versionadded:: 3.6
 
+   .. deprecated-removed:: next 3.21
+      ``ALG_SET_PUBKEY``, ``ALG_OP_SIGN`` and ``ALG_OP_VERIFY``.
+      They are libkcapi's own values and were never defined by the Linux kernel,
+      which uses the value of ``ALG_SET_PUBKEY`` for ``ALG_SET_DRBG_ENTROPY``.
+
 
 .. data:: AF_VSOCK
           IOCTL_VM_SOCKETS_GET_LOCAL_CID

Doc/whatsnew/3.16.rst

@@ -963,6 +963,14 @@ New deprecations
     3.9, now issues a deprecation warning on use. This property is slated for
     removal in 3.21. Use ``ast.Tuple.elts`` instead.
 
+* :mod:`socket`:
+
+  * ``ALG_SET_PUBKEY``, ``ALG_OP_SIGN`` and ``ALG_OP_VERIFY`` are deprecated
+    and slated for removal in Python 3.21.  They are libkcapi's own values
+    and were never defined by the Linux kernel, which uses the value of
+    ``ALG_SET_PUBKEY`` for ``ALG_SET_DRBG_ENTROPY``.
+    (Contributed by Parman Mohammadalizadeh in :gh:`158285`.)
+
 * :mod:`struct`:
 
   * The ``'F'`` and ``'D'`` type codes, soft-deprecated since Python 3.15,

Lib/socket.py

@@ -66,9 +66,15 @@
 EAGAIN = getattr(errno, 'EAGAIN', 11)
 EWOULDBLOCK = getattr(errno, 'EWOULDBLOCK', 11)
 
+# gh-158285: libkcapi's own values, never defined by mainline Linux.
+_deprecated_names = {name: globals().pop(name)
+                     for name in ('ALG_SET_PUBKEY', 'ALG_OP_SIGN', 'ALG_OP_VERIFY')
+                     if name in globals()}
+
 __all__ = ["fromfd", "getfqdn", "create_connection", "create_server",
            "has_dualstack_ipv6", "AddressFamily", "SocketKind"]
-__all__.extend(os._get_exports_list(_socket))
+__all__.extend(name for name in os._get_exports_list(_socket)
+               if name not in _deprecated_names)
 
 # Set up the socket.AF_* socket.SOCK_* constants as members of IntEnums for
 # nicer string representations.
@@ -1012,3 +1018,13 @@ def getaddrinfo(host, port, family=0, type=0, proto=0, flags=0):
                          _intenum_converter(socktype, SocketKind),
                          proto, canonname, sa))
     return addrlist
+
+
+def __getattr__(name):
+    try:
+        value = _deprecated_names[name]
+    except KeyError:
+        raise AttributeError(f"module 'socket' has no attribute {name!r}") from None
+    import warnings
+    warnings._deprecated(f"socket.{name}", remove=(3, 21))
+    return value

Lib/test/test_socket.py

@@ -951,6 +951,16 @@ def test_socket_type(self):
         with self.assertRaisesRegex(TypeError, "immutable"):
             _socket.socket.foo = 1
 
+    @unittest.skipUnless(hasattr(_socket, 'ALG_SET_PUBKEY'),
+                         'need the libkcapi ALG_* constants')
+    def test_deprecated_alg_constants(self):
+        for name in ('ALG_SET_PUBKEY', 'ALG_OP_SIGN', 'ALG_OP_VERIFY'):
+            with self.subTest(name=name):
+                self.assertNotIn(name, socket.__all__)
+                with self.assertWarnsRegex(DeprecationWarning, name):
+                    value = getattr(socket, name)
+                self.assertEqual(value, getattr(_socket, name))
+
     def test_SocketType_is_socketobject(self):
         import _socket
         self.assertTrue(socket.SocketType is _socket.socket)

Misc/NEWS.d/next/Library/2026-09-29-07-26-57.gh-issue-158285.knXIBP.rst

@@ -0,0 +1,4 @@
+Deprecate :mod:`socket` constants ``ALG_SET_PUBKEY``, ``ALG_OP_SIGN`` and
+``ALG_OP_VERIFY``. They are libkcapi's own values and were never defined by the
+Linux kernel, which uses the value of ``ALG_SET_PUBKEY`` for
+``ALG_SET_DRBG_ENTROPY``.