#1091201 sqv: Consider building with OpenSSL

Package:
sqv
Source:
sqv
Description:
Simple OpenPGP signature verification program
Submitter:
Julian Andres Klode
Date:
2025-08-19 16:45:01 UTC
Severity:
normal
#1091201#5
Date:
2024-12-23 12:20:44 UTC
From:
To:
APT now build with OpenSSL (and sqv), hence sqv is the only thing
left pulling in nettle in the base system.

In Ubuntu I applied the following lines:

override_dh_auto_install:
    dh_auto_install -- --features=crypto-openssl --no-default-features

(abusing that cargo is building in dh_auto_install only, and
dh_auto_build is a no-op)

You may have different preferences on how to express the same concept.
#1091201#10
Date:
2025-04-17 12:20:09 UTC
From:
To:
Hi,

This is a very reasonable request and I strongly support it to be
implemented for trixie. Having two libraries less in the base system is
a welcome improvement. Uploaders, would you be okay with this being
implemented?

Thanks,
Bastian
#1091201#15
Date:
2025-04-17 12:31:47 UTC
From:
To:
Hi

I think that this is the correct thing to do.

Only reason I haven't done it is a lack of free time.

//Alex
#1091201#20
Date:
2025-04-17 14:06:28 UTC
From:
To:
you'd think so, yet it was a reasonable choice to choose nettle over
openssl.

no.

certainly not now, as the trixie freeze has started. also please don't
just change the crypto library just because, similarily like you also
would not switch everything else to nettle, which would also mean one
library less.

we'll provide some longer explaination eventually.
#1091201#25
Date:
2025-04-17 15:22:08 UTC
From:
To:
FWIW, i have more confidence in Nettle as a cryptographic backend than i
have in OpenSSL.  If the project as a whole prefers to consolidate
everything to OpenSSL, i am not going to block.  But from my perspective
Nettle is better engineered, with a more sensible API (as C APIs go), a
more compact footprint, and a narrower scope of work than OpenSSL.

Nettle will also be brought back into the end user system with many
other common tools, including wget, qemu, etc.

If it was just up to me, i'd be inclined to tag this wontfix for debian.
#1091201#30
Date:
2025-08-19 12:15:38 UTC
From:
To:
Unfortunatly using Nettle breaks package repos signed with ECDH
Brainpool curves as these are not implemented in Nettle.

Please reconsider switching to Openssl as a backend for sqv.

Best regards
Stefan Thöni
#1091201#35
Date:
2025-08-19 13:18:52 UTC
From:
To:
can you give examples of such repos?
#1091201#40
Date:
2025-08-19 16:42:31 UTC
From:
To:
Unfortunatly I can't, since the repo I'm using is non-public.

The reason I chose Brainpool curves for that repo is the smartcards
holding the keys don't support the obvious choices like ed25519, gnupg
didn't support the NIST curves at that time and rsa4096 signatures take
a really long to compute on the smartcards.