Ubuntu 26.10 Will Offer a Rust-based GnuPG Replacement Option (itsfoss.com) 38
The blog It's FOSS reports:
You already know that Canonical has been selectively replacing Ubuntu's C-based system components with Rust-written equivalents that don't compromise in terms of functionality, most of the time. Now it looks like the distro's OpenPGP implementation is next, with Sequoia PGP coming preinstalled in Ubuntu 26.10. Canonical wants it to eventually replace GnuPG [the dominant Linux implementation of PGP, written in C] as the default toolchain, though that switch has not happened yet... [The Ubuntu 26.10 release notes say Sequoia PGP's default status will be a future goal...]
[Sequoia PGP] was started in 2017 by three former GnuPG developers who chose to build a new OpenPGP implementation in Rust rather than keep evolving GnuPG's existing codebase. Sequoia PGP is designed as a library that other software can use directly, rather than a standalone command-line tool. sq sits on top of that for encryption, decryption, signing, and key management, and sqv handles signature verification, filling in for gpg and gpgv in GnuPG.
Sequoia also implements RFC 9580, the 2024 revision of the OpenPGP standard, whereas GnuPG has continued from the RFC 4880 branch, pursuing its own newer extensions and the LibrePGP specification rather than adopting RFC 9580 as its primary standard.
From the It's FOSS Weekly newsletter, which also notes that the founder of the It's FOSS blog has also created a Linux-themed game called TUXDLE — a variation on Wordle where all the answers are Linux terms.
[Sequoia PGP] was started in 2017 by three former GnuPG developers who chose to build a new OpenPGP implementation in Rust rather than keep evolving GnuPG's existing codebase. Sequoia PGP is designed as a library that other software can use directly, rather than a standalone command-line tool. sq sits on top of that for encryption, decryption, signing, and key management, and sqv handles signature verification, filling in for gpg and gpgv in GnuPG.
Sequoia also implements RFC 9580, the 2024 revision of the OpenPGP standard, whereas GnuPG has continued from the RFC 4880 branch, pursuing its own newer extensions and the LibrePGP specification rather than adopting RFC 9580 as its primary standard.
From the It's FOSS Weekly newsletter, which also notes that the founder of the It's FOSS blog has also created a Linux-themed game called TUXDLE — a variation on Wordle where all the answers are Linux terms.
What can possibly go wrong (Score:3, Insightful)
Replace a long proven security program used for the most essential functions of the operation system by a clone written in rust.
People, you are signing you fucking packages with PGP. Using some rust clone just because is a catastrophe waiting to happen. When the replacement got 20 years of stable releases without major bugs, you can start considering to use it. Until then, stick to the proven solution. What's next, rewriting gnutls in rust and hoping the best? There is so much things that you can fuck up with cryptography, and memory safety is not the important trade-off. Who cares if gnupg may crash, when its clone may fail to check signatures?
Re:What can possibly go wrong (Score:4, Informative)
Rust is being added to lots of major projects in the Linux world, even including the Linux kernel. So that's newsworthy. (And it's definitely not fake.) Maybe some people want to wish that away -- but taking a deep breath and saying "fake news" real loud won't make that happen.
Also, we aren't assholes. And the site is not fucking gay now. (I'm not even sure how you're measuring that...)
Re:What can possibly go wrong (Score:4, Insightful)
you're an old and bitter man, and you've only yourself to blame
and I'm old too and a loooong time c++ professional dev (and still am) and somehow the idea of change or the word 'Rust' doesn't make me shit my pants
I feel bad for you
Needs license chnage too (Score:2)
Going back to the rewrite of smaller Linux related tools in Rust instead of keeping C versions. We can have both when warranted.
It would be better to switch to a MIT type license instead of rewriting and picking a GPL license.
Re:Needs license chnage too (Score:4, Interesting)
I don't think it's a good idea, but not for the reason you probably think.
Having multiple implementations of a de-facto standard library is basically forking. And forking is not a good thing, by and large.
It creates product redundancy while also introducing subtle differences among the forks, which both destroys the previous standard and is bad for interoperability.
Forking also splits the community into us vs them, and brings uncertainty to users who don't know which library to use. In the worst case once the libraries have diverged, users will be confused and wonder what the true standard is, and why there is such a shitshow of incompatible code everywhere.
As usual, xkcd explains it best [xkcd.com].
Re: (Score:2)
Then how to rewrite anything in another language?
They would run in parallel for some time, right?
Re: Needs license chnage too (Score:2)
Re: (Score:2, Insightful)
Re: What can possibly go wrong (Score:2)
Re: (Score:2)
Then I guess it's good I'm going to retire in ~5 years. I haven't used C professionally for larger programs in some years (just small ones), but I still remember it well enough from the 10 years that I did that I can look at a C program and know what's doing in fairly short order. By changing programs/libs to Rust, you're limiting the number of people who can/will work on OSS projects, as I and I'm sure others don't know Rust and have no plans to pick it up.
There are a number of other tasks I can do for OSS
Re: What can possibly go wrong (Score:1)
"option" (Score:3)
This is how it starts, an option... right up until they steamroll you by making it mandatory and a dependency. I recall how systemd was "optional" until it suddenly wasn't.
Re: (Score:1)
This is how it starts, an option... right up until they steamroll you by making it mandatory and a dependency.
So Rust is the new Ada? :-;
I wasn't worried about rust utils at first. (Score:2, Insightful)
This is about actual standards (Score:2)
Done (Score:4, Insightful)
That's it, I'm done with Ubuntu.
So many shitty things are being done "with AI". I love AI, but it doesn't help that the devs doing all these AI Rust tools seem to have little to zero experience with development, or thoroughness.
And for encryption? Fuck outta here.
Re: Done (Score:2)
Re: Done (Score:2)
Re: Done (Score:2)
Re: (Score:2)
This isn't news at all (Score:2)
Debian has offered Sequoia-PGP for awhile now, and works fine with its GnuPG compatibility interface. The shining feature of Sequoa-PGP is it has a well thought out command line interface and reduces several pain points I have had for decades when interacting with GnuPG.
I don't really give a hoot if it's written in rust or not, it's more useful to me than GnuPG compatibility and that's what counts.
Re: (Score:2)
If it is about the interface you can create a thin wrapper around gnupg. If you have to you can even use rust for the wrapper. Don't reinvent the wheel and don't think you can replace decades of experience with a few years of rust.
Re: (Score:2)
It also implements standards that the GnuPG team refused to implement.
Re: (Score:2)
Did the GnuPG team state why they refused to implement them?
I've tried sq a bit (Score:1)
...and it's kind of a beast to work with; there is a "chameleon" GPG wrapper which handles interop (not tried it yet), but at the base level it looks like this:
$ gpg -c calibration.html .
$ file calibration.html.gpg
calibration.html.gpg: PGP symmetric key encrypted data - AES with 256-bit key salted & iterated - SHA512
$ sq encrypt --with-password --without-signature --compression=zlib --bina
Re: (Score:2)
Wait ... wasn't compression necessary for secure cryptography because if the encrypted data is not maximum entropy, cracking becomes easier?
Ubuntu "compatible replacements" (Score:2)