- Devel - lists.sequoia-pgp.org

Sequoia 0.18.0 released
by Justus Winter 01 Aug '20

01 Aug '20

We have just released version 0.18.0 of Sequoia. The release includes the low-level crate [`sequoia-openpgp`], a program to verify detached signatures geared towards software distribution systems called [`sqv`], and a commandline frontend for Sequoia implementing the [Stateless OpenPGP Command Line Interface] called [`sqop`]. [`sequoia-openpgp`]: https://crates.io/crates/sequoia-openpgp [`sqv`]: https://crates.io/crates/sequoia-sqv [`sqop`]: https://crates.io/crates/sequoia-sop [Stateless OpenPGP Command Line Interface]: https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/ [OpenPGP interoperability test suite]: https://tests.sequoia-pgp.org/ If you use Sequoia, please port your code to the latest version and report any problems you encounter. Thank you. # Notable changes We are in the process of stabilizing the API of the low-level `sequoia-openpgp` crate. To that end, we're going over our documentation, writing more documentation and examples, and slightly amending the API to make it more consistent and easier to use. Besides that and numerous little improvements, we fixed a [bug in the parser], made certificates created using the `CertificateBuilder` [more compatible] with other implementations, and prepared Sequoia for [more cryptographic backends]. [bug in the parser]: https://gitlab.com/sequoia-pgp/sequoia/-/commit/f598646623655dac80ee5bfafee… [more compatible]: https://gitlab.com/sequoia-pgp/sequoia/-/issues/522 [more cryptographic backends]: https://gitlab.com/sequoia-pgp/sequoia/-/merge_requests/640

1 0

Sequoia 0.17.0 released
by Justus Winter 12 Jun '20

12 Jun '20

We have just released version 0.17.0 of Sequoia. The release includes the low-level crate `sequoia-openpgp`, a program to verify detached signatures geared towards software distribution systems called `sqv`, and a new commandline frontend for Sequoia implementing the [Stateless OpenPGP Command Line Interface] `sqop`. [Stateless OpenPGP Command Line Interface]: https://datatracker.ietf.org/doc/draft-dkg-openpgp-stateless-cli/ While SOP is not intended for daily use, it is a good way to interact with and explore OpenPGP implementations. SOP is primarily used as abstraction in the [OpenPGP interoperability test suite]. [OpenPGP interoperability test suite]: https://tests.sequoia-pgp.org/ If you use Sequoia, please port your code to the latest version and report any problems you encounter. Thank you. # SOP primer To demonstrate SOP, let's generate a key, and encrypt and decrypt a message: $ sqop generate-key julia(a)example.org > julia.secret.pgp $ sqop extract-cert < julia.secret.pgp > julia.public.pgp First, we generate a key for `julia(a)example.org`. Next, we extract the certificate, i.e. the key without the secret key material. $ echo "a message" | sqop encrypt julia.public.pgp > message.pgp $ sqop decrypt julia.secret.pgp < message.pgp a message Here, we encrypt a message with Julia's certificate, and decrypt it with her key.

1 0

A question about --compression pad
by Stefan Claas 14 May '20

14 May '20

Dear sequoia team, I see that the default parameter for encryption is pad. I assume that the pad function adds some random chars to the final message, prior encryption. I would like to ask, if it makes sense to you, if it would be possible to have an additional integer parameter for pad like --compression pad 1024, or say 2048 etc., which users can use, so that they always can choose an integer value they like, depending on their message size, to always have equal message(s) in size? A use case for that would be the Usenet group alt.anonymous.messages, were users could then post public key encrypted messages, done with a pub key, without a UID, which then would have always the same size. Best regards Stefan -- Signal (Desktop) +4915172173279 https://keybase.io/stefan_claas

2 2

Re: Can not sign messages sq 0.16.0
by Justus Winter 08 May '20

08 May '20

Hi :) Stefan Claas <sac(a)300baud.de> writes: > I recently compiled sq under Debian and Windows 10 and when trying to > sign a message I get this error: > > Error: Failed to build parser > > Caused by: > EOF > > I used these commands: > > sq sign -a --secret-key-file key -o test.txt message.txt Drop the -a. --append is supposed to be used if you have a signed message and you want to append your signature to it. All the best, Justus

2 1

Can not sign messages sq 0.16.0
by Stefan Claas 08 May '20

08 May '20

Hi all, I recently compiled sq under Debian and Windows 10 and when trying to sign a message I get this error: Error: Failed to build parser Caused by: EOF I used these commands: sq sign -a --secret-key-file key -o test.txt message.txt Regards Stefan -- Signal (Desktop) +4915172173279 https://keybase.io/stefan_claas

1 0

Scope of sequoia-net
by amesgen via devel 24 Feb '20

24 Feb '20

Hi, I am interested in contributing sequoia-net, specifically adding futures=0.3 support and getting keys per email address via HKP. But as sequoia-net is not published to crates.io right now, I wanted to make sure that this in in line with your plans for the project. Thanks, Alexander

2 1

How to encrypt message with ASCII key?
by Yevhenii Kurtov 10 Aug '19

10 Aug '19

Hi, In a few words I'm not even a newbie in Rust - I actually didn't wrote even a single except few exercises before, but I think time has come. I want to write a Sequoia wrapper for another language that will encrypt a message with an existing PGP key that is already present in an application as a string. A key will be received as an &str and that is where Sequoia magic has to kick in. I tried to search for how to do that and came across https://docs.sequoia-pgp.org/sequoia_guide/chapter_00/index.html#creating-a… and https://docs.sequoia-pgp.org/sequoia_guide/chapter_02/index.html#encryption First example kinda shows how to read data from an ascii text and second how to encrypt a message. Now I wonder how to combine those? :)

1 0

Progress on debian packaging for the Sequoia OpenPGP library
by Daniel Kahn Gillmor 22 May '19

22 May '19

I'm trying to get sequoia installable "the debian way", using debcargo-conf to get all of the relevant rust modules (depenencies) packaged up appropriately. I made some decent progress today, but it's still not done. This is a status report. You can see my work on the WIP-sequoia branch on https://salsa.debian.org/dkg/debcargo-conf.git Many thanks to kpcyrd, who helped me understand more about debian packaging of rust crates over on #debian-rust. Insights -------- The biggest insight I got from kpcyrd is that debian packaging is based on the packages published in crates.io, so the upstream git repository layouts are basically irrelevant to debian's perspective; so, i can package the simpler crates that have been split out from the sequoia source without too much trouble. However, this also means that keeping the parts up-to-date in debian will require as much work as there are different packages split out -- a simple upgrade to sequoia 0.8.0 won't bump all the associated packages. Problems -------- I ran into a problem with the debian packaging for string_cache_shared, which i fixed with an NMU: https://bugs.debian.org/929337 The main remaining stumbling block that (i think) is keeping me from building a significant piece of sequoia in debian at this point is that sequoia uses an older version of lalrpop. Debian rust packaging practice is to try to add only the newest version of any given crates to debian via debconf-cargo if possible. lalrpop 0.17.0 was released earlier this year, but sequoia-openpgp and sequoia-rfc2822 wants to use lalrpop = 0.16. Is this something sequoia could update to? If not, i'll need to justify the attempted inclusion of the older lalrpop. Worse, lalrpop 0.16 uses an older version of term (0.4) than what is already in debian, which would mean needing to pin that version as well, and term 0.4 itself appears to depend on older versions of kernel32-sys and winapi (why "winapi" is relevant for building on debian, i can't imagine, but i'm just flailing here and reporting what i see). Anyway, the RELEASES.md file for lalrpop doesn't make 0.17.0 sound too scary: https://github.com/lalrpop/lalrpop/blob/master/RELEASES.md I've opened: https://gitlab.com/sequoia-pgp/sequoia/merge_requests/165 to request the update to lalrpop, but the automagically-configured gitlab runner shows errors that i don't understand: https://gitlab.com/dkg/sequoia/-/jobs/216871331 Any help in resolving this would be most welcome, and might mean that we get something like sequoia in debian experimental sooner rather than later :) Thanks for all the ongoing work on sequoia! I hope this doesn't add to your troubles. --dkg

1 0

Installing Sequoia on Ubuntu
by Jan Girlich 15 Apr '19

15 Apr '19

Hi, I just tried installing Sequoia on an Ubuntu 18.04 by following the instructions on https://gitlab.com/sequoia-pgp/sequoia % git clone https://gitlab.com/sequoia-pgp/sequoia.git % git checkout v0.5.0 Did all the apt installs and double checked that I have the necessary versions of the critical components: % rustc --version rustc 1.31.0 % dpkg -l nettle-dev Gewünscht=Unbekannt/Installieren/R=Entfernen/P=Vollständig Löschen/Halten | Status=Nicht/Installiert/Config/U=Entpackt/halb konFiguriert/ Halb installiert/Trigger erWartet/Trigger anhängig |/ Fehler?=(kein)/R=Neuinstallation notwendig (Status, Fehler: GROSS=schlecht) ||/ Name Version Architektur Beschreibung +++-==============================================-============================-============================-================================================================================================== ii nettle-dev:amd64 3.4.1-1 amd64 low level cryptographic library (development files) But then: % make CARGO_TARGET_DIR=/home/jan/Projekte/sequoia/target cargo build --all Compiling docopt v1.1.0 Compiling sequoia-ffi-macros v0.5.0 (/home/jan/Projekte/sequoia/ffi-macros) error[E0658]: imports can only refer to extern crate names passed with `--extern` on stable channel (see issue #53130) --> /home/jan/.cargo/registry/src/github.com-1ecc6299db9ec823/docopt-1.1.0/src/parse.rs:48:5 | 48 | use regex; | ^^^^^ | ::: /home/jan/.cargo/registry/src/github.com-1ecc6299db9ec823/docopt-1.1.0/src/lib.rs:196:1 | 196 | / macro_rules! regex( 197 | | ($s:expr) => (regex::Regex::new($s).unwrap()); 198 | | ); | |__- not an extern crate passed with `--extern` | And many more very similar errors all complaining about the same problem in different locations. What's going wrong here? Any idea how to fix this? Cheers, Jan

2 11

State of the seedling
by Justus Winter 10 Dec '18

10 Dec '18

Hey folks :) I'd like to inform you about the recent progress on your favorite OpenPGP implementation. It has been eight weeks since I last wrote an update, and there are exciting developments to report. First of all, the Sequoia project made their [first release] at RustConf Rome during Neal's talk ([video], [slides]) about our experiences with Rust. The release includes only the low-level `openpgp` crate, which we renamed to [`sequoia-openpgp`] to avoid a namespace collision. [first release]: https://sequoia-pgp.org/blog/2018/11/26/initial-release/ [video]: https://media.ccc.de/v/rustfest-rome-6-sequoia [slides]: https://sequoia-pgp.org/talks/2018-11-rustfest-rome/sequoia-challenges-rust… [`sequoia-openpgp`]: https://crates.io/crates/sequoia-openpgp In the weeks prior to the release, we moved a lot of code around, and refined our API. For example, we introduced a [`crypto`] module and moved all low-level crypto primitives there. [`crypto`]: https://docs.sequoia-pgp.org/sequoia_openpgp/crypto/index.html When generating keys, we now always generate a revocation certificate in the hope that it will encourage the callee to store it for later use. Furthermore, our handling of revocations has been improved. We released the [bindings] for our cryptographic library, Nettle, and made Sequoia use the released version. We fixed a corner-case with Cv25519 keys encoded using OpenPGP. [bindings]: https://crates.io/crates/nettle Our command-line frontend `sq` gained a key generation subcommand, and is now able to verify detached signatures. Our C API got a significant number of new functions. Finally, our detached signature verifiaction tool [sqv] was moved to its own crate. As it only uses the low-level [`sequoia-openpgp`] crate, we were able to release it on crates.io. Furthermore, since it doesn't operate on compressed data, we are able to disable decompression support in the [`sequoia-openpgp`] crate, reducing the trusted computing base and simplifying packaging of the dependencies. Work has begun to [package] it for Debian. [sqv]: https://crates.io/crates/sequoia-sqv [package]: https://gitlab.com/sequoia-pgp/sequoia/issues/81 That's all for today, and thanks for flying Sequoia! Justus

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

Devel