On Monday, 29 December 2025 at 02:36, Demi Marie Obenour <[email protected]> wrote:
> In light of the recent GnuPG vulnerabilities, I remembered that OpenPGP > is almost never the right choice. CMS/PKCS#7 isn't any better, and > X.509 is also bad except that its extremely wide deployment in TLS > keeps it alive. > > See https://www.latacora/com/blog/2019/07/16/the-pgp-problem/ > > and https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/. OpenBSD has signify[1] and the article "Securing OpenBSD From Us To You" by the main author is worth reading. Having been a loyal GnuPG user for long years, these vulnerabilities made me reconsider my approach to signing yet again. This time, though, I decided to act on it. I wrote a clean Rust implementation of signify and called it signify-rs[3]. It uses the same license (ISC) as the reference implementation. Code is free of unsafes and arithmetic side effects. No proc macros are used in the code or any dependencies making it static-linking friendly. It's fairly portable and passes tests on FreeBSD, NetBSD, Linux and Windows. My initial goal is to switch signing Syd binary releases from gpg to signify. Next intention is to consider signing package manifests on Exherbo Linux distribution with it. If my memory serves me right, Gentoo Linux and Portage has support for GPG signed manifests and it has been a longstanding issue in Exherbo Linux how we want to do manifests. Current consensus is to use thin package manifests on a best-effort basis because we lack the developer time to go all in. Thin manifests store a single checksum and package size of the relevant package distfiles. My goal/dream is to integrate signify into this workflow and start signing thin manifests using signify. Sharing is caring, so here is the git[5] and CI[6]. CI saves static-linked signify binaries as build artifacts which gives an option to quickly test. Enjoy. Finally, my contribution is the "keyring" feature. When built with this feature on Linux, keyrings(7) support is compiled in. This adds a "-k <key-id>" argument to the subcommands -G(enerate) and -S(ign) when the user may submit a 32-bit key ID rather than inputting the passphrase manually with a prompt. [1]: https://man.openbsd.org/signify [2]: https://www.openbsd.org/papers/bsdcan-signify.html [3]: https://crates.io/crates/signify-rs [4]: https://www.kepstin.ca/blog/manifest-generation-in-exherbo/ [5]: https://git.sr.ht/~alip/signify [6]: https://builds.sr.ht/~alip/signify > -- > Sincerely, > Demi Marie Obenour (she/her/hers) Best regards, Ali Polatel
publickey - [email protected] - 0xC22DA9DE.asc
Description: application/pgp-keys
signature.asc
Description: OpenPGP digital signature
