Bug#1017688: ITP: rust-sequoia-octopus-librnp -- librnp reimplementation in Rust for Thunderbird
Package: wnpp
Severity: wishlist
Owner: Daniel Kahn Gillmor <dkg@fifthhorseman.net>
X-Debbugs-Cc: debian-devel@lists.debian.org, dkg@fifthhorseman.net
Control: affects -1 + thunderbird librnp0
* Package name : rust-sequoia-octopus-librnp
Version : 1.4.1
Upstream Author : Sequoia Project
* URL : https://gitlab.com/sequoia-pgp/sequoia-octopus-librnp
* License : LGPL-2-or-later
Programming Lang: Rust
Description : librnp reimplementation in Rust for Thunderbird
This package contains a dynamic library (shared object) with the same
interface as librnp.so.0, at least the parts used by Thunderbird.
This implementation is built in Rust by the Sequoia OpenPGP project.
This is not a complete replacement for librnp0, as Sequoia targets
only the features used by Thunderbird.
When the octopus is used in place of baseline librnp0, users should
get a number of different features, including:
- better integration with existing GnuPG keyrings, secret keys
(including smartcards), and trust annotations, for those who already
have a GnuPG installation.
- automatic background keyring refresh ("parcimonie"-style)
- carefully-planned cryptographic algorithm deprecation
- protection from surreptitious forwarding using OpenPGP's "intended
recipients" subpacket
- SHA1 collision detection
- secret keys locked while in memory, as a defense against memory
dumping attacks
The intention of this package is ultimately for a Thunderbird user to
be able to switch from librnp to the octopus with a simple package
installation (and to revert to librnp with a package uninstallation).
Early experimental versions will likely just ship the pre-built .so
and let the adventurous user handle the system integration.
Reply to: