Hey folks :)
I'd like to inform you about the recent progress on your favorite
OpenPGP implementation. It has been five weeks since my last mail,
and there are exciting developments to report.
We now emit a warning if a public interface has no documentation.
Even though we tried to document everything in the past, this will
keep us on our toes.
Sequoia can now parse Autocrypt headers, and this is exposed in the sq
frontend. So if you ever get a mail from someone using Autocrypt, you
can get her key using sq:
% sq autocrypt decode -i $(notmuch search --output=files from:look@my.amazin.horse | sort -r | head -n1)
-----BEGIN PGP PUBLIC KEY BLOCK-----
xsFNBFAB3UABEADCyB/vbIBA3m1BwcyjTieEMLySwYgt54EQ2hglOocdtIhqC+b0
...
The frontend now emits armored data by default, so that users do not
get bothered by binary OpenPGP data in case they forget to redirect
the output to a file.
Subpacket handling has been reworked, and there are now convenience
functions on the Signature type to add subpackets. The subpackets now
use high-level types, e.g. broken down time instead of the OpenPGP
wire format.
Our secret key handling has been improved. Notably, we now have a TSK
type, and can generate and serialize keys.
We now use a formal grammar to verify the structure of OpenPGP
messages and TPKs. Users of the packet parser can at any time verify
that the message they are processing in a streaming manner is in fact
a prefix of a valid message, and abort processing otherwise. When
parsing has concluded, the final result of the verification is
presented to the user.
Our C interface has received some attention. We added some missing glue
functions, and added examples. In Rust, one can include examples in the
documentation that are compiled and executed as tests. This makes sure
that examples never bitrot, and one gets a few tests for free. We
implemented the same for C examples, and updated and fixed examples that
no longer compiled. One example of such an example is this:
https://docs.sequoia-pgp.org/sequoia_ffi/openpgp/fn.sq_armor_writer_new.html
Finally, we added a LICENSE.txt file documenting the fact that Sequoia
is GPL3+.
Kai, Neal, and me went to the Delta X gathering in Freiburg. It was a
welcome opportunity to discuss Sequoia, OpenPGP, and related topics.
We also did a fair amount of hacking, and when the heat got too
intense around noon, we cooled down in the Dreisam.
As our first non-trivial consumer we started a proof-of-concept port
of delta.chat to Sequoia. Currently, delta.chat uses netpgp, and has
only modest demands in terms of OpenPGP-related functionality, making
it a good target for porting to validate and improve our C interface.
The port can be found here:
https://github.com/teythoon/deltachat-core/tree/sequoia
There was some discussion about what to do with the key server
network, because the concern is that the network might go down soon
due to either the GDPR, the recent keyserver-fs, or both. The
keyserver network is seen as a critical infrastructure for OpenPGP to
deliver key updates and revocation certificates, and poor keyserver
performance reflects badly on OpenPGP clients. As a result of this
discussion, we started implementing a new keyserver on top of Sequoia.
On Saturday there were talks at Freiburg's CCC. Kai presented ideas
on defining a subset of OpenPGP, Neal gave a talk introducing Sequoia,
and I presented our ideas on how to bring forward secrecy to OpenPGP.
Slides (and hopefully soon recordings) can be found at:
https://sequoia-pgp.org/talks/
Finally, Azul helped us get continuous integration testing up and
running on Gitlab, this will hopefully help us catch mistakes earlier.
Unfortunately, the builds on the servers provided by Gitlab are a bit
too slow to integrate it in our everyday workflow, but having a CI
system is a great step for our project.
We are going on vacation over the next month or so, so expect things
to slow down a bit in August.
That's it for now, thanks for flying with Sequoia :)
Justus
