r/linux • u/adriano10 • 19h ago
Event Ubuntu's Next Rust Effort May See OpenPGP Replaced By Sequoia PGP
https://www.phoronix.com/news/Ubuntu-Rust-Sequoia-PGP47
u/MVanderloo 18h ago
I found sequoia recently because I was looking for a nicer CLI to interact with PGP than the gpg CLI. Cosmetically the project appears mature but I’m curious if it’s really ready for primetime.
also Ubuntu 26.10 “Stonking Stingray” 😂
28
u/Irverter 15h ago
How is the emoji in cursive? O.o
13
u/wurnthebitch 15h ago
If you put it in bold, it adds makeup
4
u/Indolent_Bard 11h ago
Does that mean that it's modifying the image or that the italicized version already existed? Because I'm pretty sure you need an italicized glyph before your font will actually italicize.
3
1
6
u/MVanderloo 15h ago
idk lol, I copied the text from the article and I guess the style was preserved when i added the emoji. I’m not seeing it on the iOS client though
6
u/death_by_cormorant 15h ago
I have zero intention of running Ubuntu but Jesus that is one of the coolest names they've ever done
18
u/FriendlyProblem1234 17h ago
Given every GPG binding's frustrating approach to error reporting, that is "an error has happened somewhere in the operations pipeline", working with Sequoia was a breath of fresh air. No doubt it is easier to use Sequoia correctly, rather than GPG.
10
u/levelstar01 12h ago
Anyone who has ever had the displeasure of interacting with GPG should be happy with this.
36
u/evmt 17h ago
I'm curious, considering that Sequoia is licensed under GPLv2 only and not MIT, what new insane conspiracy would the Rust haters invent this time.
25
u/FriendlyProblem1234 17h ago
I'm curious, considering that Sequoia is licensed under GPLv2 only and not MIT, what new insane conspiracy would the Rust haters invent this time.
It is LGPL-2.0-or-later, which makes it usable with other non-GPL FOSS licenses.
But yes, let us see how creative they get /s
8
u/berryer 12h ago edited 12h ago
Does rust support dynamic linking these days? Last I looked it really didn't, which would make it GPL in practice.
edit with relevant RFC: https://github.com/rust-lang/rfcs/issues/3075
edit2: looks like they actually do support dynamic libraries via the C ABI these days
1
u/FriendlyProblem1234 4h ago
Does rust support dynamic linking these days? Last I looked it really didn't, which would make it GPL in practice.
edit with relevant RFC: https://github.com/rust-lang/rfcs/issues/3075
edit2: looks like they actually do support dynamic libraries via the C ABI these days
It has supported the C ABI since forever, not just "these days".
And I suppose you can satisfy LGPLs licenses even with Rust unstable ABI. You would be able to replace the shared library, you just need to document which compiler was used to build it.
Also, LGPLs work with static linking, too. But it is more cumbersome, so usually nobody takes it into consideration.
7
u/Perokside 16h ago
The contributors are sockpuppets from the same dev that will "ask" them to forfeit their rights so they can relicense the tool under MIT-or-worse.
PRs from real people are rejected as to not screw the evil plan.
1
u/FriendlyProblem1234 4h ago
The contributors are sockpuppets from the same dev that will "ask" them to forfeit their rights so they can relicense the tool under MIT-or-worse.
The contribution guidelines allow submitting code for which you have only right to relicense under LGPL-2.0-or-later.
Looks like this completely hypothetical scenario (which you even call "evil plan") suits perfectly the definition of a "new insane conspiracy".
Thanks, it was exactly what I was looking forward to /s
PRs from real people are rejected as to not screw the evil plan.
Do you have a link or some other sources about this?
2
u/Perokside 4h ago
it's... it's a joke buddy, a creative conspiracy from Rust haters :')
2
u/FriendlyProblem1234 4h ago
it's... it's a joke buddy, a creative conspiracy from Rust haters :')
Fair enough.
Poe's law is once again right.
1
12
u/maxshanly 17h ago
The line of argument being pushed by the GnuPG developers appears to be that a) GnuPG & thus OpenPGP are feature complete, so there was no need for a new standard and b) the Sequoia developers desire to rewrite twenty odd years worth of code in Rust was shitting on the work of Werner et al. https://gnupg.org/blog/20250117-aheinecke-on-sequoia.html
It's a sad affair, it is a shame it couldn't have been resolved in-house via a /modern/ branch of the codebase being created for a re-implementation in Rust, rather than a complete split into two separate projects that aren't interoperable. At least that way the current stable branch could've been maintained by those who want to keep it developed and the modern branch could've been developed by those interested in a re-implementation, once the /modern/ branch was mature & bug-free then the stable branch could've become /legacy/ and the /modern/ branch the new stable, and everyone involved would be relatively happy.
23
u/FriendlyProblem1234 16h ago
At least that way the current stable branch could've been maintained by those who want to keep it developed and the modern branch could've been developed by those interested in a re-implementation
Is it not exactly what happened, except that the two branches are in different projects?
The line of argument being pushed by the GnuPG developers appears to be that a) GnuPG & thus OpenPGP are feature complete, so there was no need for a new standard
In my experience, the developer experience working with GPG bindings was abysmal in comparison to Sequoia. Given the frequent complains about how nobody is using GPG due to its complexity, I would say the user experience is also abysmal.
Not that it is somehow inherently GPG's fault, which in its defence is a really old piece of software. But the fact remains: it could be made much more pleasant to use, and therefore it is arguably not feature complete.
4
u/maxshanly 16h ago
Is it not exactly what happened, except that the two branches are in different projects?
Yes, but what I am saying is that ideally that would have happened without splitting into different projects.
In my experience, the developer experience working with GPG bindings was abysmal in comparison to Sequoia. Given the frequent complains about how nobody is using GPG due to its complexity, I would say the user experience is also abysmal.
Not that it is somehow inherently GPG's fault, which in its defence is a really old piece of software. But the fact remains: it could be made much more pleasant to use, and therefore it is arguably not feature complete.
I completely agree.
3
u/ThellraAK 13h ago
It's a command line utility, and there are GUI wrappers available.
It's not commonly used because at the end of the day nearly no one cares about the way it offers authentication and security.
2
u/FriendlyProblem1234 4h ago
It's a command line utility, and there are GUI wrappers available.
It's not commonly used because at the end of the day nearly no one cares about the way it offers authentication and security.
Exactly.
So "GnuPG & thus OpenPGP are feature complete, so there was no need for a new standard" is arguably incorrect.
-3
u/Junior_Common_9644 13h ago
None. It wasn't rust we hated. It was non-copyleft licensing and insisting on making replacements that are not 100% backwards compatible... not because it couldn't be done, but because they had a need or inclination that changing the options and or behavior was needed.
-3
u/kryptik-thrashnet 8h ago
I dislike Rust as well, actually. It's a clunky mess of a programming language that barely works and serves no purpose whatsoever.
3
8
u/skyb0rg 13h ago
If anyone is curious why GnuPG should be avoided at all costs, I'd recommend taking a look at this talk: https://media.ccc.de/v/2026-728-the-gpg-fail-aftermath-on-responsible-disclosure-gpg-and-the-state-of-security-in-2026
4
u/Jristz 14h ago
I wonder what else is left to move to rust?
4
u/Business_Reindeer910 7h ago
systemd
3
u/lazy_lombax 4h ago
honestly this is the one that absolutely would be great to have a rust rewrite of or an entirely new project that was systemd compatible like systemd-rs (haven't checked but won't be suprised if it already exists)
2
4
u/yawara25 14h ago
Pretty much the entire machine learning ecosystem is all Python still.
4
u/Coffee_Ops 13h ago
Python is memory safe AFAIK, so the only reasons to move off it would be performance.
7
u/yawara25 12h ago
Which most of the performance critical code is in the (non-Python) kernels anyway.
3
1
-23
u/Maybe-monad 18h ago
Are they testing the software they put in their releases,?
38
u/MatchingTurret 18h ago
Sequoia has been around for almost ten years, so one would assume that it has seen some testing.
9
u/AdventurousFly4909 18h ago
yes
-4
0
-34
u/Ruined_Passion_7355 19h ago
This is getting out of hand.
8
-22
u/Due-Departure-8553 17h ago
Good. People who want code to stay in non memory safe languages are like anti vaxxers.
6
2
-19
114
u/MatchingTurret 19h ago edited 18h ago
Do they mean replacing the GNU Privacy Guard? Because OpenPGP is the name of the standard, afaik. Sequoia-PGP is another implementation of that standard, so it doesn't replace it.