Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #6445 > unrolled thread

Why Do Developers Continue to Sign with GNUPG

Back to article view | Back to linux.debian.security

Contents

  Why Do Developers Continue to Sign with GNUPG fosres@posteo.de - 2025-08-10 17:00 +0200
    Re: Why Do Developers Continue to Sign with GNUPG "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2025-08-10 17:50 +0200
    Re: Why Do Developers Continue to Sign with GNUPG Jeremy Stanley <fungi@yuggoth.org> - 2025-08-10 20:30 +0200
      Re: Why Do Developers Continue to Sign with GNUPG Simon Josefsson <simon@josefsson.org> - 2025-08-12 00:10 +0200
    Re: Why Do Developers Continue to Sign with GNUPG Malte <ml@enteig.net> - 2025-08-10 20:40 +0200
    Re: Why Do Developers Continue to Sign with GNUPG Gunnar Wolf <gwolf@debian.org> - 2025-08-11 07:00 +0200

#6445 — Why Do Developers Continue to Sign with GNUPG

Hello Debian Security Team,

Since Debian is a major Linux distribution I want to ask why

software developers continue to digitally sign their code an

software packages with GNUPG when there are simpler alternatives

such as minisign (https://jedisct1.github.io/minisign/), signify, or age 
(https://github.com/FiloSottile/age).

PGP has been criticized for its being difficult to use by other

cryptographers:

https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/

I thank all responses in advance!

Best,

Tanveer Salim

[toc] | [next] | [standalone]

#6446

On Sun, 2025-08-10 at 14:35 +0000, fosres@posteo.de wrote:
> Hello Debian Security Team,

For the record, you sent this mail to a public discusson list, not to
the Security Team.

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#6447

[Multipart message — attachments visible in raw view] — view raw

On 2025-08-10 14:35:20 +0000 (+0000), fosres@posteo.de wrote:
> Since Debian is a major Linux distribution I want to ask why 
> software developers continue to digitally sign their code an 
> software packages with GNUPG when there are simpler alternatives 
> such as minisign (https://jedisct1.github.io/minisign/), signify, 
> or age (https://github.com/FiloSottile/age).
[...]

While I can't speak authoritatively on the matter, you hint at the 
reason already when you use the word "continue." The other solutions 
you cite are mere infants compared to the ages of Debian (1993) and 
PGP (1991). Change takes time, and supplanting things that are 
already working well enough requires that the benefit and interest 
needed to overcome the inertia of the status quo must exceed any 
related effort and disruption that implies. In short, the 
alternatives have to be way, way, way superior for an existing 
system to get replaced.

Newer communities and ecosystems are more likely to use the things 
you mentioned primarily because they too are new enough that they 
can adopt them from the start, without incurring replacement costs.
-- 
Jeremy Stanley

[toc] | [prev] | [next] | [standalone]

#6450

[Multipart message — attachments visible in raw view] — view raw

Jeremy Stanley <fungi@yuggoth.org> writes:

> On 2025-08-10 14:35:20 +0000 (+0000), fosres@posteo.de wrote:
>> Since Debian is a major Linux distribution I want to ask why
>> software developers continue to digitally sign their code an
>> software packages with GNUPG when there are simpler alternatives
>> such as minisign (https://jedisct1.github.io/minisign/), signify, or
>> age (https://github.com/FiloSottile/age).
> [...]
>
> While I can't speak authoritatively on the matter, you hint at the
> reason already when you use the word "continue." The other solutions
> you cite are mere infants compared to the ages of Debian (1993) and
> PGP (1991). Change takes time, and supplanting things that are already
> working well enough requires that the benefit and interest needed to
> overcome the inertia of the status quo must exceed any related effort
> and disruption that implies. In short, the alternatives have to be
> way, way, way superior for an existing system to get replaced.

I believe the SSH signature format is old enough to be a relevant option
here.  SSH signatures didn't used to offer any advantage compared to
PGP, but I think now that an GnuPG-incompatible OpenPGP specification
has harmed the PGP ecosystem and made the PGP world less coherent, I
think SSH signatures offers an interesting alternative.  FWIW, Guix is
working on adding support for it, so that both SSHSIG and PGP signatures
may be used.

/Simon

[toc] | [prev] | [next] | [standalone]

#6448

I think that with the gnupg developer having left the development of the
OpenPGP standard, and Debian switching to the sequoia, there will be a
graceful shift away from gnupg, and towards the newer versions of
OpenPGP that deprecate a lot of the convoluted and insecure parts that
old versions of gnupg/openpgp were rightfully criticized for.

fosres@posteo.de transcribed 0.5K bytes on 10-Aug-2025 14:35:
> Hello Debian Security Team,
> 
> Since Debian is a major Linux distribution I want to ask why
> 
> software developers continue to digitally sign their code an
> 
> software packages with GNUPG when there are simpler alternatives
> 
> such as minisign (https://jedisct1.github.io/minisign/), signify, or age
> (https://github.com/FiloSottile/age).
> 
> PGP has been criticized for its being difficult to use by other
> 
> cryptographers:
> 
> https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/
> 
> I thank all responses in advance!
> 
> Best,
> 
> Tanveer Salim
> 

[toc] | [prev] | [next] | [standalone]

#6449

[Multipart message — attachments visible in raw view] — view raw

fosres@posteo.de dijo [Sun, Aug 10, 2025 at 02:35:20PM +0000]:
>Hello Debian Security Team,
>
>Since Debian is a major Linux distribution I want to ask why
>
>software developers continue to digitally sign their code an
>
>software packages with GNUPG when there are simpler alternatives
>
>such as minisign (https://jedisct1.github.io/minisign/), signify, or 
>age (https://github.com/FiloSottile/age).

There are many cryptographic implementations that get part of the benefits
of OpenPGP, but don't get fully there. OpenPGP is an IETF standard, that
was recently (one year ago) updated with newer algorithms, practices and
usages.

As Malte said in this thread, the developers of the tool most of our
fingers know best, GnuPG, has chosen to follow a different path and fork
the standard -- of course, only time will tell if their "LibrePGP" gains
any traction, but I am betting it will be marginal.

Most Free Software projects (there are many!) that base parts of their
infrastructure in OpenPGP are considering switching away from GnuPG towards
newer alternatives, such as the already mentioned Sequoia. There are
various other implementations, but my personal opinion is that Sequoia is
the most serious, better thought out, user-friendlier — and, yes, most
secure. I'm betting my chips on us gradually switching over our
infrastructure to be based on Sequoia.

Greetings,

     – Gunnar.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web