Upstream NEWS file ** Summary changed:
- Please merge 1.4.0 into Stonking + FFe: Please merge 1.4.0 into Stonking ** Description changed: + ## FFE ## + + [Rationale] + + * rust-sequoia-sq has a pending MIR and is in-progress for becoming the + preferred OpenPGP implementation on Ubuntu. Having the latest version + on Stonking will allow for it to be tested sufficiently before reaching LTS. + More specifically it introduces support for post-quantum cryptography which + is a highly requested feature in today's crypto climate. + + * The upload will fix a FTBFS issue related to OpenSSL 4.0 + + [ Scope ] + + * Major changes (excerpt from upstream NEWS): + - Adds: + + Post-quantum cryptography (as defined in RFC 9980) + + The cipher suites Cv448, MLDSA65_Ed25519, and MLDSA87_Ed448 + + The ability to specify the precise algorithm used for encryption-capable + keys and signing-capable keys + - Fixes: + + If `sq` is directed towards a special file (character devices, block + devices, FIFOs, and UNIX domain sockets), callers no longer have to + specify `--overwrite` if the file already exists + + `sq` uses a temporary staging file in case a command fails. This version + fixes an issue where it was not possible to move this file on success + to special files, and when the destination directory was not writable. + + Sensitive content output by `sq` to regular files restrict the + permissions to prevent others from accessing the data + + `sq` will not panic on a broken pipe + + * The only dependency on the binary package produced (`sq`) is by + `python3-software-properties` which specifies `Depends: gpg | sq` + + $ seeded-in-ubuntu sq -b + sq is not seeded (and may not exist). + + // The current rust-sequoia-sq FTBFS due to OpenSSL 4.0 + + * Upstream NEWS: + ``` + ** New functionality + - `sq` now supports post quantum cryptography as defined in + RFC 9980. + - When directing `sq` to write to a file that already exists, the + user had to specify `--overwrite`. This is no longer required + for special files (character devices, block devices, FIFOs and + Unix domain sockets). + - When writing to a file, `sq` would first write to a temporary + file in the same directory to avoid writing anything if the + command fails. If the command succeeds, it would move the file + into place. This would fail when writing to special files + (character devices, block devices, FIFOs and Unix domain sockets) + like `/dev/null` and when the directory is not writable. In + these cases, `sq` now writes to a temporary file in the user's + temporary directory (often under `/tmp`) and then copies the + file. + - If `sq` outputs sensitive content to a regular file like keys or + revocation certificates, it restricts the output file's + permissions on Unix-like operating systems so that the group + permissions and other permissions don't allow access to the data. + - You can use `sq key generate --encryption-algorithm` and `sq key + generate --signing-algorithm` to specify the precise algorithm + that `sq key generate` will use for encryption-capable keys and + signing-capable keys, respectively. + - Add the cipher suites Cv448, MLDSA65_Ed25519, and MLDSA87_Ed448, + which can be used to control what algorithms `sq key generate` + and `sq key subkey add` use. + - `sq` no longer panics on a broken pipe. Instead it acts like + other tools and exits with an exit code of 128 + SIGPIPE. + ** Notable fixes + - `sq download` no longer freezes if some of the passed URLs return a + '404 - not found' error when trying to fetch them. + ``` + + [ Regression Potential ] + + * Any regressions would most likely be discovered in the `sq` tool itself: + - A notable regression might be observed in how this version will handle + permissions differently for sensitive regular files (like keys or + revocation certificates). Scripts may thusly break if they were reliant on + the files having more relaxed file permissions. + - Callers may not be aware that directing `sq` writes to a special file + (character devices, block devices, FIFOs, and UNIX domain sockets), will + overwrite that file by default if it exists without requiring `--overwrite` + + [ Testing ] + + * Smoke test: + - PPA: https://launchpad.net/~bamf0/+archive/ubuntu/stonking-rust-sequoia-sq-merge-lp2161399/+packages + - Build: https://launchpad.net/~bamf0/+archive/ubuntu/stonking-rust-sequoia-sq-merge-lp2161399/+builds?build_text=&build_state=built + - Installation: (Command output used) + ``` + root@test-sq:~# lsb_release -a + No LSB modules are available. + Distributor ID: Ubuntu + Description: Ubuntu Stonking Stingray (development branch) + Release: 26.10 + Codename: stonking + root@test-sq:~# apt policy sq + sq: + Installed: (none) + Candidate: 1.4.0-0ubuntu1~ppa2 + Version table: + 1.4.0-0ubuntu1~ppa2 500 + 500 https://ppa.launchpadcontent.net/bamf0/stonking-rust-sequoia-sq-merge-lp2161399/ubu> + 1.3.1-10ubuntu1 500 + 500 http://archive.ubuntu.com/ubuntu stonking/universe amd64 Packages + root@test-sq:~# apt install sq + Upgrading: + openssl openssl-provider-legacy + + Installing: + sq + + Installing dependencies: + libssl4 + + Summary: + Upgrading: 2, Installing: 2, Removing: 0, Not Upgrading: 168 + Download size: 10.2 MB + Space needed: 31.7 MB / 301 GB available + + Continue? [Y/n]y + ... + root@test-sq:~# sq version + sq 1.4.0 + using sequoia-openpgp 2.4.0 + with cryptographic backend OpenSSL 4.0.1 + ``` + - Upgrade: (Command output used) + ``` + root@test-sq:~# sq version + sq 1.3.1 + using sequoia-openpgp 2.0.0 + with cryptographic backend OpenSSL + root@test-sq:~# apt install sq=1.4.0-0ubuntu1~ppa2 + Upgrading: + sq + + Summary: + Upgrading: 1, Installing: 0, Removing: 0, Not Upgrading: 168 + Download size: 6519 kB + Space needed: 1499 kB / 301 GB available + + Get:1 https://ppa.launchpadcontent.net/bamf0/stonking-rust-sequoia-sq-merge-lp2161399/ubuntu stonking/main amd64 sq amd64 1.4.0-0ubuntu1~ppa2 [6519 kB] + Fetched 6519 kB in 3s (2190 kB/s) + (Reading database ... 44625 files and directories currently installed.) + Preparing to unpack .../sq_1.4.0-0ubuntu1~ppa2_amd64.deb ... + Unpacking sq (1.4.0-0ubuntu1~ppa2) over (1.3.1-10ubuntu1) ... + Setting up sq (1.4.0-0ubuntu1~ppa2) ... + Processing triggers for man-db (2.13.1-1build1) ... + ... + root@test-sq:~# apt policy sq + sq: + Installed: 1.4.0-0ubuntu1~ppa2 + Candidate: 1.4.0-0ubuntu1~ppa2 + Version table: + *** 1.4.0-0ubuntu1~ppa2 500 + 500 https://ppa.launchpadcontent.net/bamf0/stonking-rust-sequoia-sq-merge-lp2161399/ubu> + 100 /var/lib/dpkg/status + 1.3.1-10ubuntu1 500 + 500 http://archive.ubuntu.com/ubuntu stonking/universe amd64 Packages + + ``` + - Autopkgtest: N/A (no autopkgtests available) + - Does it break other packages: No. + + * Additional smoke testing for the updated package: + - Generated a v4 key using `sq key generate` (OK) + - Generated a v6 key (https://www.rfc-editor.org/rfc/rfc9580.html) using + `sq key generate --profile rfc9580` (OK) + - Exported keys using `sq` (OK) + - Generated a v6 key using the PQC cipher-suite MLDSA65_Ed25519 (OK) + - Verified that permissions are stricter for output key files in 1.4.0. + Only the owner can read the file, in 1.3.0 group and others also have + read-permission (OK) + + [ Other Info ] + + * Debian has a revision of this version, although it only refreshes the + patches that we've already processed in previous merges. + + [ Original Description ] + Tracking bug. ** Attachment added: "NEWS" https://bugs.launchpad.net/ubuntu/+source/rust-sequoia-sq/+bug/2161399/+attachment/5998864/+files/NEWS ** Changed in: rust-sequoia-sq (Ubuntu) Status: In Progress => New ** Description changed: - ## FFE ## + ## FFe ## [Rationale] * rust-sequoia-sq has a pending MIR and is in-progress for becoming the - preferred OpenPGP implementation on Ubuntu. Having the latest version - on Stonking will allow for it to be tested sufficiently before reaching LTS. - More specifically it introduces support for post-quantum cryptography which - is a highly requested feature in today's crypto climate. + preferred OpenPGP implementation on Ubuntu. Having the latest version + on Stonking will allow for it to be tested sufficiently before reaching LTS. + More specifically it introduces support for post-quantum cryptography which + is a highly requested feature in today's crypto climate. * The upload will fix a FTBFS issue related to OpenSSL 4.0 [ Scope ] * Major changes (excerpt from upstream NEWS): - - Adds: - + Post-quantum cryptography (as defined in RFC 9980) - + The cipher suites Cv448, MLDSA65_Ed25519, and MLDSA87_Ed448 - + The ability to specify the precise algorithm used for encryption-capable - keys and signing-capable keys - - Fixes: - + If `sq` is directed towards a special file (character devices, block - devices, FIFOs, and UNIX domain sockets), callers no longer have to - specify `--overwrite` if the file already exists - + `sq` uses a temporary staging file in case a command fails. This version - fixes an issue where it was not possible to move this file on success - to special files, and when the destination directory was not writable. - + Sensitive content output by `sq` to regular files restrict the - permissions to prevent others from accessing the data - + `sq` will not panic on a broken pipe + - Adds: + + Post-quantum cryptography (as defined in RFC 9980) + + The cipher suites Cv448, MLDSA65_Ed25519, and MLDSA87_Ed448 + + The ability to specify the precise algorithm used for encryption-capable + keys and signing-capable keys + - Fixes: + + If `sq` is directed towards a special file (character devices, block + devices, FIFOs, and UNIX domain sockets), callers no longer have to + specify `--overwrite` if the file already exists + + `sq` uses a temporary staging file in case a command fails. This version + fixes an issue where it was not possible to move this file on success + to special files, and when the destination directory was not writable. + + Sensitive content output by `sq` to regular files restrict the + permissions to prevent others from accessing the data + + `sq` will not panic on a broken pipe * The only dependency on the binary package produced (`sq`) is by - `python3-software-properties` which specifies `Depends: gpg | sq` + `python3-software-properties` which specifies `Depends: gpg | sq` $ seeded-in-ubuntu sq -b sq is not seeded (and may not exist). // The current rust-sequoia-sq FTBFS due to OpenSSL 4.0 * Upstream NEWS: ``` ** New functionality - - `sq` now supports post quantum cryptography as defined in - RFC 9980. - - When directing `sq` to write to a file that already exists, the - user had to specify `--overwrite`. This is no longer required - for special files (character devices, block devices, FIFOs and - Unix domain sockets). - - When writing to a file, `sq` would first write to a temporary - file in the same directory to avoid writing anything if the - command fails. If the command succeeds, it would move the file - into place. This would fail when writing to special files - (character devices, block devices, FIFOs and Unix domain sockets) - like `/dev/null` and when the directory is not writable. In - these cases, `sq` now writes to a temporary file in the user's - temporary directory (often under `/tmp`) and then copies the - file. - - If `sq` outputs sensitive content to a regular file like keys or - revocation certificates, it restricts the output file's - permissions on Unix-like operating systems so that the group - permissions and other permissions don't allow access to the data. - - You can use `sq key generate --encryption-algorithm` and `sq key - generate --signing-algorithm` to specify the precise algorithm - that `sq key generate` will use for encryption-capable keys and - signing-capable keys, respectively. - - Add the cipher suites Cv448, MLDSA65_Ed25519, and MLDSA87_Ed448, - which can be used to control what algorithms `sq key generate` - and `sq key subkey add` use. - - `sq` no longer panics on a broken pipe. Instead it acts like - other tools and exits with an exit code of 128 + SIGPIPE. + - `sq` now supports post quantum cryptography as defined in + RFC 9980. + - When directing `sq` to write to a file that already exists, the + user had to specify `--overwrite`. This is no longer required + for special files (character devices, block devices, FIFOs and + Unix domain sockets). + - When writing to a file, `sq` would first write to a temporary + file in the same directory to avoid writing anything if the + command fails. If the command succeeds, it would move the file + into place. This would fail when writing to special files + (character devices, block devices, FIFOs and Unix domain sockets) + like `/dev/null` and when the directory is not writable. In + these cases, `sq` now writes to a temporary file in the user's + temporary directory (often under `/tmp`) and then copies the + file. + - If `sq` outputs sensitive content to a regular file like keys or + revocation certificates, it restricts the output file's + permissions on Unix-like operating systems so that the group + permissions and other permissions don't allow access to the data. + - You can use `sq key generate --encryption-algorithm` and `sq key + generate --signing-algorithm` to specify the precise algorithm + that `sq key generate` will use for encryption-capable keys and + signing-capable keys, respectively. + - Add the cipher suites Cv448, MLDSA65_Ed25519, and MLDSA87_Ed448, + which can be used to control what algorithms `sq key generate` + and `sq key subkey add` use. + - `sq` no longer panics on a broken pipe. Instead it acts like + other tools and exits with an exit code of 128 + SIGPIPE. ** Notable fixes - - `sq download` no longer freezes if some of the passed URLs return a - '404 - not found' error when trying to fetch them. + - `sq download` no longer freezes if some of the passed URLs return a + '404 - not found' error when trying to fetch them. ``` [ Regression Potential ] * Any regressions would most likely be discovered in the `sq` tool itself: - - A notable regression might be observed in how this version will handle - permissions differently for sensitive regular files (like keys or - revocation certificates). Scripts may thusly break if they were reliant on - the files having more relaxed file permissions. - - Callers may not be aware that directing `sq` writes to a special file - (character devices, block devices, FIFOs, and UNIX domain sockets), will - overwrite that file by default if it exists without requiring `--overwrite` + - A notable regression might be observed in how this version will handle + permissions differently for sensitive regular files (like keys or + revocation certificates). Scripts may thusly break if they were reliant on + the files having more relaxed file permissions. + - Callers may not be aware that directing `sq` writes to a special file + (character devices, block devices, FIFOs, and UNIX domain sockets), will + overwrite that file by default if it exists without requiring `--overwrite` [ Testing ] * Smoke test: - - PPA: https://launchpad.net/~bamf0/+archive/ubuntu/stonking-rust-sequoia-sq-merge-lp2161399/+packages - - Build: https://launchpad.net/~bamf0/+archive/ubuntu/stonking-rust-sequoia-sq-merge-lp2161399/+builds?build_text=&build_state=built - - Installation: (Command output used) + - PPA: https://launchpad.net/~bamf0/+archive/ubuntu/stonking-rust-sequoia-sq-merge-lp2161399/+packages + - Build: https://launchpad.net/~bamf0/+archive/ubuntu/stonking-rust-sequoia-sq-merge-lp2161399/+builds?build_text=&build_state=built + - Installation: (Command output used) ``` root@test-sq:~# lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu Stonking Stingray (development branch) Release: 26.10 Codename: stonking root@test-sq:~# apt policy sq sq: - Installed: (none) - Candidate: 1.4.0-0ubuntu1~ppa2 - Version table: - 1.4.0-0ubuntu1~ppa2 500 - 500 https://ppa.launchpadcontent.net/bamf0/stonking-rust-sequoia-sq-merge-lp2161399/ubu> - 1.3.1-10ubuntu1 500 - 500 http://archive.ubuntu.com/ubuntu stonking/universe amd64 Packages + Installed: (none) + Candidate: 1.4.0-0ubuntu1~ppa2 + Version table: + 1.4.0-0ubuntu1~ppa2 500 + 500 https://ppa.launchpadcontent.net/bamf0/stonking-rust-sequoia-sq-merge-lp2161399/ubu> + 1.3.1-10ubuntu1 500 + 500 http://archive.ubuntu.com/ubuntu stonking/universe amd64 Packages root@test-sq:~# apt install sq Upgrading: - openssl openssl-provider-legacy + openssl openssl-provider-legacy Installing: - sq + sq Installing dependencies: - libssl4 + libssl4 Summary: - Upgrading: 2, Installing: 2, Removing: 0, Not Upgrading: 168 - Download size: 10.2 MB - Space needed: 31.7 MB / 301 GB available + Upgrading: 2, Installing: 2, Removing: 0, Not Upgrading: 168 + Download size: 10.2 MB + Space needed: 31.7 MB / 301 GB available Continue? [Y/n]y ... root@test-sq:~# sq version sq 1.4.0 using sequoia-openpgp 2.4.0 with cryptographic backend OpenSSL 4.0.1 ``` - - Upgrade: (Command output used) + - Upgrade: (Command output used) ``` root@test-sq:~# sq version sq 1.3.1 using sequoia-openpgp 2.0.0 with cryptographic backend OpenSSL root@test-sq:~# apt install sq=1.4.0-0ubuntu1~ppa2 Upgrading: - sq + sq Summary: - Upgrading: 1, Installing: 0, Removing: 0, Not Upgrading: 168 - Download size: 6519 kB - Space needed: 1499 kB / 301 GB available + Upgrading: 1, Installing: 0, Removing: 0, Not Upgrading: 168 + Download size: 6519 kB + Space needed: 1499 kB / 301 GB available Get:1 https://ppa.launchpadcontent.net/bamf0/stonking-rust-sequoia-sq-merge-lp2161399/ubuntu stonking/main amd64 sq amd64 1.4.0-0ubuntu1~ppa2 [6519 kB] Fetched 6519 kB in 3s (2190 kB/s) (Reading database ... 44625 files and directories currently installed.) Preparing to unpack .../sq_1.4.0-0ubuntu1~ppa2_amd64.deb ... Unpacking sq (1.4.0-0ubuntu1~ppa2) over (1.3.1-10ubuntu1) ... Setting up sq (1.4.0-0ubuntu1~ppa2) ... Processing triggers for man-db (2.13.1-1build1) ... ... root@test-sq:~# apt policy sq sq: - Installed: 1.4.0-0ubuntu1~ppa2 - Candidate: 1.4.0-0ubuntu1~ppa2 - Version table: - *** 1.4.0-0ubuntu1~ppa2 500 - 500 https://ppa.launchpadcontent.net/bamf0/stonking-rust-sequoia-sq-merge-lp2161399/ubu> - 100 /var/lib/dpkg/status - 1.3.1-10ubuntu1 500 - 500 http://archive.ubuntu.com/ubuntu stonking/universe amd64 Packages + Installed: 1.4.0-0ubuntu1~ppa2 + Candidate: 1.4.0-0ubuntu1~ppa2 + Version table: + *** 1.4.0-0ubuntu1~ppa2 500 + 500 https://ppa.launchpadcontent.net/bamf0/stonking-rust-sequoia-sq-merge-lp2161399/ubu> + 100 /var/lib/dpkg/status + 1.3.1-10ubuntu1 500 + 500 http://archive.ubuntu.com/ubuntu stonking/universe amd64 Packages ``` - - Autopkgtest: N/A (no autopkgtests available) - - Does it break other packages: No. + - Autopkgtest: N/A (no autopkgtests available) + - Does it break other packages: No. * Additional smoke testing for the updated package: - - Generated a v4 key using `sq key generate` (OK) - - Generated a v6 key (https://www.rfc-editor.org/rfc/rfc9580.html) using - `sq key generate --profile rfc9580` (OK) - - Exported keys using `sq` (OK) - - Generated a v6 key using the PQC cipher-suite MLDSA65_Ed25519 (OK) - - Verified that permissions are stricter for output key files in 1.4.0. - Only the owner can read the file, in 1.3.0 group and others also have - read-permission (OK) + - Generated a v4 key using `sq key generate` (OK) + - Generated a v6 key (https://www.rfc-editor.org/rfc/rfc9580.html) using + `sq key generate --profile rfc9580` (OK) + - Exported keys using `sq` (OK) + - Generated a v6 key using the PQC cipher-suite MLDSA65_Ed25519 (OK) + - Verified that permissions are stricter for output key files in 1.4.0. + Only the owner can read the file, in 1.3.0 group and others also have + read-permission (OK) [ Other Info ] * Debian has a revision of this version, although it only refreshes the - patches that we've already processed in previous merges. + patches that we've already processed in previous merges. [ Original Description ] Tracking bug. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161399 Title: FFe: Please merge 1.4.0 into Stonking To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rust-sequoia-sq/+bug/2161399/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
