I submitted the package botan3 for review [1] some weeks ago. Fedora currently have botan (1.x) and botan2 (2.x).
A user in the mailing list mentioned that I didn't even need to go through review for a "new" package that it is just a major version update of an existing one, however, another user began the review and I let it be because I do appreciate the good feedback he was giving me. As part of the review feedback he called for a Python SIG exception confirmation and a Crypto Team review, which quickly became blockers.

Reasons to add botan3:

• Botan2 went EOL at the beginning of this year 2025 (I have been backporting security patches from botan 3).
• Give time upstream to migrate to botan3.
• Three of the dependencies using botan2 can migrate to botan3 immediately [3][4][5]. The other dependency, corectl is less sure. Thunderbird depends on rnp, but rnp could be changed to be based on openssl instead of botan.
• Botan 3.x as a library has some popularity, recommended by a Gov [6], and already present in major distros like Alpine, Debian, Gentoo or OpenSUSE [6]. Deprecating it from Fedora would only add extra burden on packagers that will need to bundle botan, which some package already did at some point [8].

Python SIG confirmation

The issue is that the package does not have botan in PyPI. However, I asked for an exception while waiting for upstream to resolve the issue [2], upon the argument that botan python binding is already in Fedora and this would be a major version update.

I'm still waiting for the Python SIG response.

Crypto Team review

Botan doesn't use openssl. The review from the crypto team focused in that fact, and that Fedora should not keep having non-openssl libraries that are not managed by the crypto team with profiles. See the original review ticket for details of the discussion [1]. Botan itself has a policy mechanism as well that could be leveraged to address some of the concerns, but wouldn't be in the scope of this major version update.
Though I understand the motivation, as I mentioned above in the reasons to add botan3, I disagree that in this case we should drop the effort to do this major version update. This is the main reason for contacting the packaging team, which is to ask for an exception for this major package update.

Thank you for looking into this!
Carlos R.F.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2394931
[2] https://github.com/randombit/botan/issues/5103
[3] https://github.com/pbek/QOwnNotes/blob/b3bb0c40f2bc3dda1d74eaac5a3597ae27ece25f/src/libraries/botan/CMakeLists.txt#L18
[4] https://github.com/keepassxreboot/keepassxc/blob/c0ea6f65f934858944a9eae5b584dc8c5ae9471a/CMakeLists.txt#L210
[5] https://github.com/rnpgp/rnp/blob/0d5c2b9191b5d28968f4f32bbc36f26a616c6146/CMakeLists.txt#L126
[6] https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Kryptografie/Kryptobibliothek-Botan/kryptobibliothek-botan_node.html
[7] https://repology.org/project/botan/versions
[8] https://src.fedoraproject.org/rpms/qownnotes/blob/rawhide/f/qownnotes.spec#_100