[From nobody Mon Jul  6 20:13:04 2026
Received: (at 1140558-done) by bugs.debian.org; 6 Jul 2026 19:11:47 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=-14.3 required=4.0 tests=BAYES_00,FROMDEVELOPER,
 HAS_BUG_NUMBER,PGPSIGNATURE,SPF_HELO_NONE,SPF_SOFTFAIL,VERSION
 autolearn=ham autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 30; hammy, 150; neutral, 46; spammy,
 0. spammytokens: hammytokens:0.000-+--H*ct:application,
 0.000-+--H*ct:protocol, 0.000-+--H*ct:micalg, 0.000-+--H*ct:signed,
 0.000-+--H*ct:pgp-signature
Return-path: <dkg@debian.org>
Received: from che.mayfirst.org ([2001:470:1:116::7]:35897)
 by buxtehude.debian.org with esmtps
 (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256)
 (Exim 4.96) (envelope-from <dkg@debian.org>) id 1wgojL-007PN8-0z;
 Mon, 06 Jul 2026 19:11:47 +0000
Received: from fifthhorseman.net (AMERICAN-CI.ear2.NewYork6.Level3.net
 [4.59.214.2])
 (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
 key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)
 (No client certificate requested)
 by che.mayfirst.org (Postfix) with ESMTPSA id E609FF94A;
 Mon, 06 Jul 2026 15:04:39 -0400 (EDT)
Received: by fifthhorseman.net (Postfix, from userid 1000)
 id 17C4013F714; Mon, 06 Jul 2026 15:04:37 -0400 (EDT)
From: Daniel Kahn Gillmor <dkg@debian.org>
To: Chris =?utf-8?Q?Hofst=C3=A4dtler?= <zeha@debian.org>,
 1140558@bugs.debian.org, 1140558-done@bugs.debian.org
Subject: Re: Bug#1140558: Clarify openssl vs nettle usage in Debian
In-Reply-To: <ajlt9BzvN3tRponw@per.namespace.at>
References: <ajlt9BzvN3tRponw@per.namespace.at>
Autocrypt: addr=dkg@fifthhorseman.net; prefer-encrypt=mutual; keydata=
 xjMEZXEJyxYJKwYBBAHaRw8BAQdA5BpbW0bpl5qCng/RiqwhQINrplDMSS5JsO/YO+5Zi7HNFzxk
 a2dAZmlmdGhob3JzZW1hbi5uZXQ+wsARBBMWCgB5AwsJB0cUAAAAAAAeACBzYWx0QG5vdGF0aW9u
 cy5zZXF1b2lhLXBncC5vcmcS78JIJ7JbALqPiKEmva7/Pp16WwXWm9hbe5+B/UvnfwMVCggCmwEC
 HgEWIQTUdwQMcMIValwphUm7fpEBSV5r9wUCZadfkAUJBdnwRQAKCRC7fpEBSV5r9yNXAP442N0c
 zvisBroQSKKpo+OWm2JpnEJWoVheeJvoRtkBGQEA+edHylby8IGcNccq7rmM2rAXdofvrU1o6qow
 V+mmDwbOMwRnio4OFgkrBgEEAdpHDwEBB0Cw9HzJFl9lZn3UBaUqSMSgxjcdbd0MwNVcGZ8t8wdN
 EcLAvwQYFgoBMQWCZ4qODgkQu36RAUlea/dHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9p
 YS1wZ3Aub3JnhcN+tn41cAg01Kk56zcAfpdsh8j98PDe00mqKPfFvaYCmwK+oAQZFgoAbwWCZ4qO
 DgkQeAuFTtnCtJZHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnxsD8Sk5P
 Wgx8c/Zseo6OlCjyDC+Ogm17gTaUUIpxjWYWIQRjrBGOWy5dZsiKhad4C4VO2cK0lgAAdcQA/1RG
 dmrmvVxkBY2qNPjtERNwPga8Pf4IdlenrZ03NXM4AQC+TDHMpD7d5obEvUy8GYI3oThzYItPP8vv
 ChY+wbaIBRYhBNR3BAxwwhVqXCmFSbt+kQFJXmv3AAAKbgD+K1MZXnRKPdmA8DgNysyGRZY8cSVH
 HQcC7ZAAtV3i2+wA/0CyOYrbFYbyTRALgoERR07OHFoP+fJopQLMNQARVUELzjgEZ4qN+RIKKwYB
 BAGXVQEFAQEHQDTGlR+Qmn334e+bPqvojJVdFsiBf0leAAHP+ESqop8NAwEIB8LAAAQYFgoAcgWC
 Z4qN+QkQu36RAUlea/dHFAAAAAAAHgAgc2FsdEBub3RhdGlvbnMuc2VxdW9pYS1wZ3Aub3JnA5Lw
 b3wOOcoodImuVNw4PYq1U65FDC1Q2JMFIcJXqF0CmwwWIQTUdwQMcMIValwphUm7fpEBSV5r9wAA
 6egA/j3QANSmogZ5VTF5KlI+BBye9ud/w9j7RLcCHU6u8AA1AQC3FGaNuv+uWOSa+eeEoI/aZrGd
 X5el8b/m6aXDDxDjDg==
Date: Mon, 06 Jul 2026 15:04:36 -0400
Message-ID: <87echgx7ln.fsf@fifthhorseman.net>
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-=";
 micalg=pgp-sha512; protocol="application/pgp-signature"
X-Greylist: delayed 424 seconds by postgrey-1.37 at buxtehude;
 Mon, 06 Jul 2026 19:11:47 UTC
X-CrossAssassin-Score: 2

--=-=-=
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Version: 1.3.1-11

On Mon 2026-06-22 19:16:36 +0200, Chris Hofst=C3=A4dtler wrote:
> while researching sq on various operating systems, I've noticed that=20
> various other distros use the OpenSSL backend, while Debian's sq=20
> uses the nettle backend.

Debian has been shipping sequoia tooling since before there was an
openssl backend.  Nettle is a solid cryptographic library, one with
significantly better ergonomics than OpenSSL's complex API surface.

nettle also happens to be sequoia's default cryptographic backend.

> That seemed fine, however debcargo.toml also claims some openssl=20
> dependency:
>
> https://sources.debian.org/src/rust-sequoia-sq/1.3.1-10/debian/debcargo.t=
oml#L16
>
>   [packages.bin]
>   multi_arch =3D "foreign"
>   depends =3D [ "openssl" ]

This was fixed by Alexander Kjall in 1.3.1-11.  Thanks for catching it,
Chris!

> That left me wondering if Debian's sq was meant to use openssl=20
> instead of nettle.

I think we should stick to nettle unless there is some compelling and
explicit reason to switch cryptographic backends.

         --dkg

--=-=-=
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

wr0EARYKAG8FgmpL/EQJEHgLhU7ZwrSWRxQAAAAAAB4AIHNhbHRAbm90YXRpb25z
LnNlcXVvaWEtcGdwLm9yZ97pk+edB63li7/WWwTaGZhCMNA1qeWvpNZhP9JiCcby
FiEEY6wRjlsuXWbIioWneAuFTtnCtJYAAAwAAQDaoXM2brJviuGpPWzqok1ie4Vy
tvE+n0LP9XPFm/fY9AEAt3u8OCT+oQi9lzlBT7VwEYPH946dah0aDctlPORucwc=
=yC3D
-----END PGP SIGNATURE-----
--=-=-=--
]