"RPM now uses the Rust-written Sequoia OpenGPG parser for better security."

Congratulations to @nwalfield and the #SequoiaPGP team!

@fedora

I just released version 0.1.5 of the simple experimental standalone SSH agent for #OpenPGP cards (https://crates.io/crates/openpgp-card-ssh-agent/).

This is a minor update in terms of functionality.

However, it marks a move of the crate to the @Codeberg platform (including an integration test in Codeberg's Woodpecker CI, testing the agent against a virtual OpenPGP card: https://ci.codeberg.org/openpgp-card/ssh-agent/pipeline/31)

#OpenSSH #OpenPGPCard #SequoiaPGP

The #SequoiaPGP team has released version 1.5.0 of https://crates.io/crates/sequoia-octopus-librnp, the Sequoia-based alternative #OpenPGP backend for #Thunderbird.

This release fixes support for Thunderbird 102.7, and contains a big overhaul for Web of Trust calculations, which automatically set Thunderbird's "acceptance" of OpenPGP certificates based on published certifications and the trust roots the user configured in their GnuPG subsystem.

#Octopus

@macst3r Und ewig dauert der Build auch noch:Beispielsweise braucht #SequoiaPGP auf meinem Rechner fast eine dreiviertel Stunde. Die Tests kann ich nicht mal laufen lassen, weil dann der Speicher ausgeht, weil Cargo soviel overhead Dateien erzeugt. (Build läuft im Container in /tmp)

@thunderbird
When will #Thunderbird use #SequoiaPGP instead of the buggy rnp library? Esp. since sequoia is written in rust.

When will #Thunderbird implement easy encryption be default with automatic key-roll-over, like #pEp #prettyEasyPrivacy does? Or simply make pEp default part of TB?

@Fu GnuPG works, but no one seems to like using it. The #SequoiaPGP project is re-writing PGP in Rust, as a library with a command line interface built on top, and with a detailed test suite. So that seems promising in itself. But beyond that, there is a new RFC coming for OpenPGP, with seven or so different PGP projects collaborating on it -- the ecosystem is growing.

I've also recently set up a #Protonmail account, finally giving me a reason to configure, test and use PGP signed e-mails.

Just watched the talk by Justus Winter from #Debconf22 . He did a great job explaining #SequoiaPGP . There are lots of reasons for optimism regarding #OpenPGP .

https://gemmei.ftp.acc.umu.se/pub/debian-meetings/2022/DebConf22/debconf22-67-sequoia-pgp-v5-openpgp-authentication-and-debian.lq.webm

@nwalfield

#Debian

@saxnot
Have you tried the Octopus from #SequoiaPGP ? https://sequoia-pgp.org/blog/2021/04/08/202103-a-new-backend-for-thunderbird/

(I haven't used it myself.)

@ArneBab
@thunderbird

#pgp #thunderbird

@civodul Switch from #GnuPG to #SequoiaPGP maybe? keys.openpgp.com is running a server written by that project, so presumably it works with their software.

https://sequoia-pgp.org/blog/2019/06/14/20190614-hagrid/

I wonder if @nwalfield would have any suggestions.

#PGP

@fikran I use #PGP to encrypt a few files on my hard drive. I use it via #Emacs . I set it up for e-mails too, several years ago, but I haven't had reason to use it.

Have a look at https://sequoia-pgp.org/ if you want to become more optimistic about PGP.

#SequoiaPGP

I've published the summary of my interviews of #sq stakeholders. sq is one a command line encryption tool using #OpenPGP, by tthe #SequoiaPGP project.

https://sequoia-pgp.org/blog/2022/03/02/202203-sq-stakeholder-interviews/

@emacsen Doesn't the #SequoiaPGP project have some sort of plan for this?

Strike that, I should have read the article before replying.

@kensanata @cosullivan @klaatu More tutorials on #GPG could only be a good thing. And ones for using GPG with #emacs too.

(In five years perhaps the tutorials should be about transitioning to #SequoiaPGP .)

Today I've build the #pEp #python adapter for #guix, using the #sequoiapgp backend. Nice! I'm eager to see releases announced to I can bring it into guix.

I also implemented a simple example for sending encrypted messages between peers, using a custom XML based message format. This shows how easy it is to send encrypted messages without using MIME format.
https://pep.foundation/dev/repos/pEpPythonAdapter/rev/671d9e268e71

#crypto

Yesterday #sequoiapgp landed in #guix. I'm looking forward for their 1.0 release and an improved #python interface.

Yeah! After packaging estimated 90 new Rust package for #guix, I now have #SequoiaPgp running in Guix. Now I "just" need to clean up the patches for submission. Hopefully in two weeks time #sequoia will officially available in Guix.

https://sequoia-pgp.org/
#pep #pgp #gnupg

Please don't tell me, #rust being a great language. The language might be, but the compiler and tool-chain are a crap.

One can not pre-build packages, but each library will be build again and again for every application using it. This is a waste of time and energy - and climate pollution.

Example: Building #SequoiaPgp, a mid-sizes application comparable to GnuPG, takes 40 minutes, and requires 9.7G (giga!) disk-space. 220 packages are compiled, and 235 pkgs for "make check"
#sequoia

A free implementation of OpenPGP in Rust - Project Sequoia is planning to release v1.0 at the end of January.

https://gitlab.com/sequoia-pgp/sequoia/-/milestones/1

#PGP #SequoiaPGP #Rust

Uploaded my #OpenPGP key to the new key server at keys.openpgp.net.

Unlike others, this server does not utilize the web of trust. Instead it validates user identities by E-Mail

I don't agree with their policy of not signing the keys upon validation though. If a user retrieves a key from the service, there is no means of telling where the key has come from later on. Could have been anywhere

#GnuPG #SequoiaPGP

https://keys.openpgp.org/about/news#2019-06-12-launch