- Devel - lists.sequoia-pgp.org

CV448
by me＠paulapplegate.com 13 Apr '23

13 Apr '23

When installing Sequoia sq ( v0.29), I checked the version after the install and saw, sq 0.29.0 (sequoia-openpgp 1.14.0, using Nettle 3.8 (Cv448: true)). Not wanting to assume anything, but how does one activate the cv448 ECC curve? I see cv448 mentioned a lot especially in the "justus/ocb" branch. Thanks Paul

2 1

Sequoia sq: 0.29.0
by Neal H. Walfield 07 Apr '23

07 Apr '23

Hi everyone, I'm pleased to announce the release of version 0.29.0 of Sequoia sq, our general-purpose command-line tool for Sequoia PGP. I have published sequoia-sq on crates.io: https://crates.io/crates/sequoia-sq You can also fetch version 0.29.0 using the v0.29.0 tag: https://gitlab.com/sequoia-pgp/sequoia-sq/-/tags/v0.29.0 which I signed: $ git verify-tag v0.29.0 gpg: Signature made Fri Apr 07 23:52:44 2023 +02:00 gpg: using RSA key C03FA6411B03AE12576461187223B56678E02528 gpg: Good signature from "Neal H. Walfield <neal(a)walfield.org>" [ultimate] gpg: "Neal H. Walfield <neal(a)gnupg.org>" gpg: "Neal H. Walfield <neal(a)pep-project.org>" gpg: "Neal H. Walfield <neal(a)pep.foundation>" gpg: "Neal H. Walfield <neal(a)sequoia-pgp.org>" sq version 0.29.0 is packed full of exciting, user-visible changes. This release of sq is the culmination of two years of work, and includes several major user-visible improvements. To date, sq has operated in a stateless manner: users explicitly passed the keys and certificates that it should operate on, and implemented their own trust model by maintaining an ad-hoc curated keyring. Version 0.29.0 of sq adds support for a certificate store, includes a powerful web-of-trust engine based on flow networks, and introduces an easier-to-use interface, sq link, to manage authentication decisions based on concepts from how people use address books. Here's a quick demo of downloading a certificate from keys.openpgp.org: $ sq keyserver get neal(a)sequoia-pgp.org Recorded provenance information for DC09F5862D531848CBC4C0D8C6AD186AB030E354, "Downloaded from the keyserver keys.openpgp.org" Created the local CA "Downloaded from the keyserver keys.openpgp.org" for certifying certificates downloaded from this service. The CA's trust amount is set to 1 of 120. Use `sq link add --ca '*' --amount N DC09F5862D531848CBC4C0D8C6AD186AB030E354` to override it. Or `sq link retract DC09F5862D531848CBC4C0D8C6AD186AB030E354` to disable it. Recorded provenance information for 8F17777118A33DDA9BA48E62AACB3243630052D9, "Neal H. Walfield <neal(a)gnupg.org>" Recorded provenance information for 8F17777118A33DDA9BA48E62AACB3243630052D9, "Neal H. Walfield <neal(a)pep-project.org>" Recorded provenance information for 8F17777118A33DDA9BA48E62AACB3243630052D9, "Neal H. Walfield <neal(a)sequoia-pgp.org>" Recorded provenance information for 8F17777118A33DDA9BA48E62AACB3243630052D9, "Neal H. Walfield <neal(a)walfield.org>" Importing 1 certificates into the certificate store: 1. 8F17777118A33DDA9BA48E62AACB3243630052D9 Neal H. Walfield <neal(a)walfield.org> Imported 1 new certificates, updated 0 certificates, 0 certificates unchanged, 0 errors. After checking that a certificate really belongs to the stated owner, use "sq link add FINGERPRINT" to mark the certificate as authenticated. We see that `sq` has saved the provenance information, and explains how to link the certificate and the identity. When we now look up the certificate associated with neal(a)sequoia-pgp.org, we see that it has been certified by a minimally trusted, local, shadow CA for keys.openpgp.org, which is in turn certified by the local trust root: $ sq wot lookup --email neal(a)sequoia-pgp.org [ ] 8F17777118A33DDA9BA48E62AACB3243630052D9 Neal H. Walfield <neal(a)sequoia-pgp.org>: marginally authenticated (0%) ◯ 15BEF9EDD4759647BE5F008AAD0B4189CE8A7D1B ("Local Trust Root") │ partially certified (amount: 1 of 120) the following certificate on 2023-04-07 as a partially trusted (1 of 120) introducer (depth: 1) ├ DC4981E703D4448C778396EDA349F3FA419E04AC ("Downloaded from the keyserver keys.openpgp.org") │ certified the following binding on 2023-04-07 └ 8F17777118A33DDA9BA48E62AACB3243630052D9 "Neal H. Walfield <neal(a)sequoia-pgp.org>" Could not authenticate any paths. If we are convinced that keys.openpgp.org is reliable, then we can easily change how much we rely on the the shadow CA to check email addresses: $ sq link add --ca \* DC4981E703D4448C778396EDA349F3FA419E04AC --all DC4981E703D4448C778396EDA349F3FA419E04AC, Downloaded from the keyserver keys.openpgp.org was already linked at 2023-04-07 22:34:48 UTC. Updating trust amount: 1 -> 120. Update trust depth: 1 -> 255. Updating exportable flag: true -> false. Link parameters changed, updating link. Linking DC4981E703D4448C778396EDA349F3FA419E04AC and "Downloaded from the keyserver keys.openpgp.org". Now, that certificate and any user IDs that were returned by keys.openpgp.org are considered fully authenticated: $ sq wot lookup --email neal(a)sequoia-pgp.org [✓] 8F17777118A33DDA9BA48E62AACB3243630052D9 Neal H. Walfield <neal(a)sequoia-pgp.org>: fully authenticated (100%) ◯ 15BEF9EDD4759647BE5F008AAD0B4189CE8A7D1B ("Local Trust Root") │ certified the following certificate on 2023-04-07 as a fully trusted meta-introducer (depth: unconstrained) ├ DC4981E703D4448C778396EDA349F3FA419E04AC ("Downloaded from the keyserver keys.openpgp.org") │ certified the following binding on 2023-04-07 └ 8F17777118A33DDA9BA48E62AACB3243630052D9 "Neal H. Walfield <neal(a)sequoia-pgp.org>" And we can address the certificate by user ID or email: $ echo 'Hi Neal!' | sq encrypt --recipient-email neal(a)walfield.org -----BEGIN PGP MESSAGE----- ... If we ever change our mind about how much we are willing to rely on keys.openpgp.org, we can easily modify the link, or even retract it: $ sq link retract DC4981E703D4448C778396EDA349F3FA419E04AC DC4981E703D4448C778396EDA349F3FA419E04AC, Downloaded from the keyserver keys.openpgp.org was linked at 2023-04-07 22:37:52 UTC. Updating trust amount: 120 -> 0. Update trust depth: 255 -> 0. Link parameters changed, updating link. Breaking link between DC4981E703D4448C778396EDA349F3FA419E04AC and "Downloaded from the keyserver keys.openpgp.org". $ sq link list DC4981E703D4448C778396EDA349F3FA419E04AC, "Downloaded from the keyserver keys.openpgp.org"'s link was retracted. I've published an introduction to all the new functionality as well as the motivation for some of our unconventional design decisions in a blog post: https://sequoia-pgp.org/blog/2023/04/08/sequoia-sq/ The list of changes in 0.29 is: * New functionality - `sq` now supports and implicitly uses a certificate store. By default, `sq` uses the standard OpenPGP certificate directory. This is located at `$HOME/.local/share/pgp.cert.d` on XDG compliant systems. - `sq --no-cert-store`: A new switch to disable the use of the certificate store. - `sq --cert-store`: A new option to use an alternate certificate store. Currently, only OpenPGP certificate directories are supported. - `sq import`: A new command to import certificates into the certificate store. - `sq export`: A new command to export certificates from the certificate store. - `sq encrypt --recipient-cert`: A new option to specify a recipient's certificate by fingerprint or key ID, which is then looked up in the certificate store. - `sq verify --signer-cert`: A new option to specify a signer's certificate by fingerprint or key ID, which is then looked up in the certificate store. - `sq verify` now also implicitly looks for missing certificates in the certificate store. But, unless they are explicitly named using `--signer-cert`, they are not considered authenticated and the verification will always fail. - `sq certify`: If the certificate to certify is a fingerprint or Key ID, then the corresponding certificate is looked up in the certificate store. - Add a global option, `--time`, to set the reference time. This option replaces the various subcommand's `--time` argument as well as `sq key generate` and `sq key userid add`'s `--creation-time` arguments. - Add top-level option, `--trust-root`, to allow the user to specify trust roots. - Extend `sq encrypt` to allow addressing recipients by User ID (`--recipient-userid`) or email address (`--recipient-email`). Only User IDs that can be fully authenticated are considered. - Extend `sq verify` to verify certificates looked up from the certificate store using the web of trust. If the signature includes a Signer's User ID packet, and the binding can be fully authenticated, consider the signature to be authenticated. If there is no Signer's User ID packet, consider the signature to be authenticated if any binding can fully be authenticated. - Add `sq link add`, which uses the local trust root to certify the specified bindings. - Add `sq link retract`, which retracts certifications made by the local trust root on the specified bindings. - Add `sq link list`, which lists the links. - Add a top-level option, `--keyring`, to allow the user to specify additional keyrings to search for certificates. - Import web of trust subcommands from sq-wot. Specifically, add: - `sq wot authenticate` to authenticate a binding. - `sq wot lookup` to find a certificate with a particular User ID. - `sq wot identify` to list authenticated bindings for a certificate. - `sq wot list` to list authenticated bindings. - `sq wot path` to authenticate and lint a path in a web of trust. - `sq keyserver get`, `sq wkd get`, and `sq dane get` now import any certificates into the certificate store by default instead of exporting them on stdout. It is still possible to export them using the `--output` option. - When `sq keyserver get` (for verifying key servers), `sq wkd get`, or `sq dane get` saves a certificate to the local certificate store, `sq` certifies the validated User IDs (all returned User IDs in the case of verifying key servers; User IDs that contain the looked up email address in the case of WKD and DANE) using a local service-specific proxy CA. If the proxy key doesn't exist, it is created, and certified as a minimally trusted CA (trust amount 1 of 120) by the local trust root. The proxy certificates can be managed in the usual way using `sq link add` and `sq link retract`. - Extend `sq inspect` to inspect certificates from the certificate store using the `--cert` option. * Deprecated functionality - `sq key generate --creation-time TIME` is deprecated in favor of `sq key generate --time TIME`. - `sq key user id --creation-time TIME` is deprecated in favor of `sq user id --time TIME`. Neal on behalf of the whole Sequoia PGP team

1 0

sequoia-wot 0.7.1
by Neal H. Walfield 07 Apr '23

07 Apr '23

Hi everyone, I'm pleased to announce the release of version 0.7.1 of the Sequoia Web of Trust crate, sequoia-wot. I have published sequoia-wot on crates.io: https://crates.io/crates/sequoia-wot You can also fetch version 0.7.1 using the v0.7.1 tag: https://gitlab.com/sequoia-pgp/sequoia-wot/-/tags/v0.7.1 which I signed: $ git verify-tag v0.7.1 gpg: Signature made Fri Apr 07 21:31:36 2023 +02:00 gpg: using RSA key C03FA6411B03AE12576461187223B56678E02528 gpg: Good signature from "Neal H. Walfield <neal(a)walfield.org>" [ultimate] gpg: "Neal H. Walfield <neal(a)gnupg.org>" gpg: "Neal H. Walfield <neal(a)pep-project.org>" gpg: "Neal H. Walfield <neal(a)pep.foundation>" gpg: "Neal H. Walfield <neal(a)sequoia-pgp.org>" This release fixes a minor bug. Unfortunately, certifications of User IDs that are not self-signed were ignored. This feature is useful for implementing petnames. This is now fixed. https://en.wikipedia.org/wiki/Petname Neal on behalf of the whole Sequoia PGP team

1 0

sequoia-wot 0.7.0
by Neal H. Walfield 24 Mar '23

24 Mar '23

Hi everyone, I'm pleased to announce the release of version 0.7.0 of the Sequoia Web of Trust crate, sequoia-wot. I have published sequoia-wot on crates.io: https://crates.io/crates/sequoia-wot You can also fetch version 0.7.0 using the v0.7.0 tag: https://gitlab.com/sequoia-pgp/sequoia-wot/-/tags/v0.7.0 which I signed: $ git verify-tag v0.7.0 gpg: Signature made Fri Mar 24 11:31:41 2023 +01:00 gpg: using RSA key C03FA6411B03AE12576461187223B56678E02528 gpg: Good signature from "Neal H. Walfield <neal(a)walfield.org>" [ultimate] gpg: "Neal H. Walfield <neal(a)gnupg.org>" gpg: "Neal H. Walfield <neal(a)pep-project.org>" gpg: "Neal H. Walfield <neal(a)pep.foundation>" gpg: "Neal H. Walfield <neal(a)sequoia-pgp.org>" This release includes an exciting new feature: the ability to render the output as a graphical network in DOT format. The DOT output can in turn be compiled into an SVG using Graphviz's DOT compiler. This is a great usability improvement. This feature was implemented by David Runge, a new Sequoia contributor. Here's an example of how to use it. David says that he is an Arch Linux developer. We can see what Arch developers have certified a certificate with his email address by running: $ sq-wot --format dot \ --keyring usr/share/pacman/keyrings/archlinux.gpg \ --gossip lookup \ --email dvzrv(a)archlinux.org \ | dot -Tsvg -o /tmp/dvzrv.svg The attached SVG shows the result. Neal on behalf of the whole Sequoia PGP team

1 0

sequoia-net 0.27.0
by Neal H. Walfield 24 Mar '23

24 Mar '23

Hi everyone, I'm pleased to announce the release of version 0.27.0 of sequoia-net, a library for looking up certificates on OpenPGP keyservers, in web key directories (WKDs), and using DANE. I have published sequoia-net on crates.io: https://crates.io/crates/sequoia-net You can also fetch version 0.27.0 using the net/v0.27.0 tag: https://gitlab.com/sequoia-pgp/sequoia/-/tags/net/v0.27.0 which I signed: $ git verify-tag net/v0.27.0 gpg: Signature made Fri Mar 24 10:36:11 2023 +01:00 gpg: using RSA key C03FA6411B03AE12576461187223B56678E02528 gpg: Good signature from "Neal H. Walfield <neal(a)walfield.org>" [ultimate] gpg: "Neal H. Walfield <neal(a)gnupg.org>" gpg: "Neal H. Walfield <neal(a)pep-project.org>" gpg: "Neal H. Walfield <neal(a)pep.foundation>" gpg: "Neal H. Walfield <neal(a)sequoia-pgp.org>" The main change in this release is switching DANE from using ring to OpenSSL. As we already use OpenSSL, this reduces the number of dependencies, and the trusted computing base. Neal on behalf of the whole Sequoia PGP team

1 0

sequoia-openpgp 1.14.0
by Neal H. Walfield 23 Mar '23

23 Mar '23

Hi everyone, I'm pleased to announce the release of version 1.14.0 of sequoia-openpgp, our low-level OpenPGP library. I have published sequoia-openpgp on crates.io: https://crates.io/crates/sequoia-openpgp You can also fetch version 1.14.0 using the openpgp/v1.14.0 tag: https://gitlab.com/sequoia-pgp/sequoia/-/tags/openpgp/v1.14.0 which I signed: $ git verify-tag openpgp/v1.14.0 gpg: Signature made Thu Mar 23 15:43:58 2023 +01:00 gpg: using RSA key C03FA6411B03AE12576461187223B56678E02528 gpg: Good signature from "Neal H. Walfield <neal(a)walfield.org>" [ultimate] gpg: "Neal H. Walfield <neal(a)gnupg.org>" gpg: "Neal H. Walfield <neal(a)pep-project.org>" gpg: "Neal H. Walfield <neal(a)pep.foundation>" gpg: "Neal H. Walfield <neal(a)sequoia-pgp.org>" A notable change in this release is support for Botan, a new cryptographic backend: https://botan.randombit.net/ sequoia-openpgp now supports five cryptographic backends: - Nettle - OpenSSL - Botan - Windows CNG (Windows only) - Rust Crypto We also audited our protected memory mechanism, and found that there are several cases where secrets were not cleared when the memory was freed. We created a tool to partially automate searching for these types of leaks. We've fixed the cases that we found. For those interested in the details, please refer to these MRs: https://gitlab.com/sequoia-pgp/sequoia/-/merge_requests/1436/commits https://gitlab.com/sequoia-pgp/sequoia/-/merge_requests/1440/commits This release includes several minor performance improvements. In addition, the following functionality was added: - crypto::mem::Protected::new - crypto::mpi::SecretKeyMaterial::from_bytes - crypto::mpi::SecretKeyMaterial::from_bytes_with_checksum - fmt::hex::Dumper::with_offset - parse::buffered_reader re-export - policy::AsymmetricAlgorithm::BrainpoolP384 - RawCert implements Parse And, the following functions were deprecated: - crypto::mpi::SecretKeyMaterial::parse - crypto::mpi::SecretKeyMaterial::parse_with_checksum Neal on behalf of the whole Sequoia PGP team

1 0

sequoia-wot 0.6.0
by Neal H. Walfield 09 Mar '23

09 Mar '23

Hi everyone, I'm pleased to announce the release of version 0.6.0 of the Sequoia Web of Trust crate, sequoia-wot. I have published sequoia-wot on crates.io: https://crates.io/crates/sequoia-wot You can also fetch version 0.6.0 using the v0.6.0 tag: https://gitlab.com/sequoia-pgp/sequoia-wot/-/tags/v0.6.0 which I signed: $ git verify-tag v0.6.0 gpg: Signature made Thu Mar 09 14:39:29 2023 +01:00 gpg: using RSA key C03FA6411B03AE12576461187223B56678E02528 gpg: Good signature from "Neal H. Walfield <neal(a)walfield.org>" [ultimate] gpg: "Neal H. Walfield <neal(a)gnupg.org>" gpg: "Neal H. Walfield <neal(a)pep-project.org>" gpg: "Neal H. Walfield <neal(a)pep.foundation>" gpg: "Neal H. Walfield <neal(a)sequoia-pgp.org>" The most noticeable change in this release is that we switched from providing our own certificate store abstraction to using the one provided by sequoia-cert-store. More information about sequoia-cert-store is available here: https://docs.rs/sequoia-cert-store/0.2.0/sequoia_cert_store/ We also added a wrapper struct so that it is easy to work with a `CertStore`, which is provided by the Certificate Store library, or any other data structure implementing the Store trait. The following code snippet illustrates the idea: use std::borrow::Cow; use sequoia_openpgp as openpgp; use openpgp::cert::CertBuilder; use openpgp::packet::UserID; use openpgp::policy::StandardPolicy; use sequoia_cert_store as cert_store; use cert_store::Store; use cert_store::StoreUpdate; use sequoia_wot as wot; use wot::Network; use wot::Query; use wot::Roots; const P: &StandardPolicy = &StandardPolicy::new(); let mut cert_store = cert_store::CertStore::empty(); cert_store.update(Cow::Owned(alice.clone().into()))?; cert_store.update(Cow::Owned(bob.clone().into()))?; // Build a WoT network. let trust_roots = Roots::from(&[ (alice.fingerprint().into(), wot::FULLY_TRUSTED), ]); let wot_data = wot::store::CertStore::from_backend(&cert_store, P, None); let network = Network::new(&wot_data)?; let q = Query::new(&network, trust_roots.clone()); // Try and authenticate Bob. let paths = q.authenticate( UserID::from("<bob(a)example.org>"), bob.fingerprint(), wot::FULLY_TRUSTED); // Alice, our sole trust root, did not certify Bob so this will fail. assert_eq!(paths.amount(), 0); Since we depend on sequoia-cert-store, we can also remove redundant code, like the keyserver implementation, which sequoia-cert-store also implements. Neal on behalf of the whole Sequoia PGP team

1 0

Sequoia Certificate Store v0.2.0
by Neal H. Walfield 07 Mar '23

07 Mar '23

Hi everyone, I'm pleased to announce the release of version 0.2.0 of the Sequoia Certificate Store crate, sequoia-cert-store. I have published sequoia-cert-store on crates.io: https://crates.io/crates/sequoia-cert-store You can also fetch version 0.2.0 using the v0.2.0 tag: https://gitlab.com/sequoia-pgp/sequoia-cert-store/-/tags/v0.2.0 which I signed: $ git verify-tag v0.2.0 gpg: Signature made Tue Mar 07 17:39:46 2023 +01:00 gpg: using RSA key C03FA6411B03AE12576461187223B56678E02528 gpg: Good signature from "Neal H. Walfield <neal(a)walfield.org>" [ultimate] gpg: "Neal H. Walfield <neal(a)gnupg.org>" gpg: "Neal H. Walfield <neal(a)pep-project.org>" gpg: "Neal H. Walfield <neal(a)pep.foundation>" gpg: "Neal H. Walfield <neal(a)sequoia-pgp.org>" sequoia-cert-store provides a unified, high-level API for different certificate stores via its Store and StoreUpdate traits. This version fixes an issue with `CertStore`'s key server backend: calling `CertStore::add_keyserver` accidentally did not enable key server support. This release also includes several other improvements to the key server backend. A notable improvement is the addition of a generic interface, `store::StatusListener`, which allows a backend to indicate when a certificate look up starts and ends. This is implemented by the key server backend. This allows an application to better show the user that the application is working and not hung when using a key server. Neal on behalf of the whole Sequoia PGP team

1 0

rpm-sequoia 1.3.0
by Neal H. Walfield 06 Mar '23

06 Mar '23

Hi everyone, I'm pleased to announce v1.3.0 of the RPM Sequoia crate. I have published rpm-sequoia on crates.io: https://crates.io/crates/rpm-sequoia You can also fetch version 1.3.0 using the v1.3.0 tag: https://github.com/rpm-software-management/rpm-sequoia/releases/tag/v1.3.0 which I signed: $ git verify-tag v1.3.0 gpg: Signature made Mon Mar 06 16:54:07 2023 +01:00 gpg: using RSA key C03FA6411B03AE12576461187223B56678E02528 gpg: Good signature from "Neal H. Walfield <neal(a)walfield.org>" [ultimate] gpg: "Neal H. Walfield <neal(a)gnupg.org>" gpg: "Neal H. Walfield <neal(a)pep-project.org>" gpg: "Neal H. Walfield <neal(a)pep.foundation>" gpg: "Neal H. Walfield <neal(a)sequoia-pgp.org>" This release includes two notable changes. First, when `pgpVerifySignature` verifies a signature, it now distinguishes between an invalid signature, and one that uses weak cryptography, or is from a certificate that is expired or has been revoked. Specifically, in the case that the signature is okay, but the cryptography is weak or the certificate is invalid, `pgpVerifySignature` now returns `RPMRC_NOTTRUSTED` instead of `RPMRC_FAIL`. This change allows installed packages, which use outdated cryptography or certificates to be updated or removed. Please refer to this comment: https://bugzilla.redhat.com/show_bug.cgi?id=2170878#c8 and this issue: https://github.com/rpm-software-management/rpm/issues/2402 for more details. Second, rpm-sequoia now looks for its configuration file by first checking the environment variable `RPM_SEQUOIA_CRYPTO_POLICY` and the file `/etc/crypto-policies/back-ends/rpm-sequoia.config`. Only if both of those are not set does it fallback to the more generic `SEQUOIA_CRYPTO_POLICY` environment variable and the file `/etc/crypto-policies/back-ends/sequoia.config`. This change allows RPM to use a different cryptographic policy from other Sequoia-based applications. It was motivated by Fedora 38's decision to allow signatures using the SHA-1 hash algorithm and made by 1024-bit DSA keys, which is necessary to support some popular third-party repositories. For more details, refer to: https://bugzilla.redhat.com/show_bug.cgi?id=2170878 , https://pagure.io/fesco/issue/2960 , and https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/merge_requests/129 . Neal on behalf of the whole Sequoia PGP team

1 0

sequoia-policy-config 0.6.0
by Neal H. Walfield 06 Mar '23

06 Mar '23

Hi everyone, I'm pleased to announce v0.6.0 of the Sequoia Policy Config crate, sequoia-policy-config. I have published sequoia-policy-config on crates.io: https://crates.io/crates/sequoia-policy-config You can also fetch version 0.6.0 using the v0.6.0 tag: https://gitlab.com/sequoia-pgp/sequoia-policy-config/-/tags/v0.6.0 which I signed: $ git verify-tag v0.6.0 gpg: Signature made Mon Mar 06 15:11:44 2023 +01:00 gpg: using RSA key C03FA6411B03AE12576461187223B56678E02528 gpg: Good signature from "Neal H. Walfield <neal(a)walfield.org>" [ultimate] gpg: "Neal H. Walfield <neal(a)gnupg.org>" gpg: "Neal H. Walfield <neal(a)pep-project.org>" gpg: "Neal H. Walfield <neal(a)pep.foundation>" gpg: "Neal H. Walfield <neal(a)sequoia-pgp.org>" This release adds a few new functions that make it easier to use an alternate configuration name space. In particular, `ConfiguredStandardPolicy::parse_default_config` was split into the following functions: `ConfiguredStandardPolicy::parse_env_config`, `ConfiguredStandardPolicy::parse_config_file`, and `ConfiguredStandardPolicy::parse_config`. This was motivated by Fedora 38, which needs to enable some legacy algorithms to give third parties additional time to update their OpenPGP certificates. We decided that just because these algorithms are enabled for rpm does not mean that they should to be enabled for all applications that use Sequoia. The relevant issue is here: https://bugzilla.redhat.com/show_bug.cgi?id=2170878 Neal on behalf of the whole Sequoia PGP team

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

Devel