Document differences between internal and Sequoia GPG backends

[ffesti]

With the internal GPG parser being stripped down and being very incomplete from the beginning we need to document the differences to the Sequoia backend so people have an incentive to use the later and to understand why builds with the internal backend are limited.

[nwalfield]

Good point. Where would be a good place to document this?

[pmatilai]

I think a simple blurb in INSTALL alongside the crypto options explanations would go a long way. That's where people making such a choice should be looking at anyhow.

[nwalfield]

I think it makes sense to make a list before writing a text. Here's what I've thought of so far:

• Sequoia reads the crypto policy from "/etc/crypto-policies/back-ends/sequoia.config;" the internal parser relies on the crypto backend to do that (OpenSSL does; libgcrypt doesn't)
• Sequoia lints certificates at import time (cf. https://github.com/rpm-software-management/rpm/issues/1974#issuecomment-1081779174)
• Sequoia checks certificate validity at time of use (the internal implementation only checks at time of import) (cf. https://github.com/rpm-software-management/rpm/issues/1978#issuecomment-1097677144)
• Sequoia's list of supported features is here: https://sequoia-pgp.org/status/
• Sequoia supports subkeys
• Sequoia supports Nettle, OpenSSL, RustCrypto and Windows CNG as Crypto backends; the internal implementation supports libgcrypt and OpenSSL.

[nwalfield]

This is related to https://pagure.io/fedora-docs/release-notes/issue/892 , I think.

[pmatilai]

Another one for the list:

• the internal parser doesn't verify sub-packet binding signatures (notably user id).

Note that I wouldn't go too deep into these technicalities in the INSTALL blurb, just something broad that helps a person decide against using the internal parser :laughing: But I agree, having a list will help make a point.

[pmatilai]

It wont hurt to elaborate on the Fedora change either, but I think the primary interest here is to convince people building rpm by themselves (and especially for their distro) that they really should bother with Rust for this.

[nwalfield]

Someone looked at this thread and privately asked me to forward their suggestions:

• rpm-sequoia and sequoia are written in a safe systems programming language (Rust)
• A focus of Sequoia's development process is on testing, so rpm-sequoia and sequoia probably have more formal (unit, integration) testing than the internal OpenPGP implementation. Although it has less real-world testing, obviously.

[pmatilai]

I only added a brief blurb to INSTALL. My primary interest here is to scare people away from the internal implementation :ghost:, not to document every technical detail that differs...

[nwalfield]

Looks good, thanks for adding this.