Hello,

thanks for packaging Sequoia.

The package contains a user-facing tool, and the package description
contains mostly redundant technical details about how the package is
generated.

Could you please update the description so that it explains what the sq
command is supposed to do, so that one could use the description to see
if it's a package that might do some of what they need?


Enrico

Hi Enrico--

Sorry for the long delay in getting back to you.

At the time you wrote this, i think the sq package description was
pretty similar to what it is today:

--------
Description: OpenPGP command-line tool from Sequoia
 sq is a command-line interface for OpenPGP, structured using
 subcommands and implemented in Rust.
 .
 Subcommands include: help, decrypt, encrypt, sign, verify, armor,
 dearmor, autocrypt, inspect, key, keyring, certify, packet.
 .
 It offers modern cryptographic algorithms by default, like Ed25519 and
 Curve25519.
 .
 The tool offers both message handling (encryption, decryption,
 signing, and verification), and key and certificate management (key
 generation, certificate maintenance, and certification), and is
 interoperable with other major OpenPGP implementations like GnuPG
 (gpg).
 .
 WARNING: sq does not have a stable CLI interface yet.  Use with
 caution in scripts.
 This package contains the following binaries built from the Rust crate
 "sequoia-sq":
  - sq
--------

This contains the fact that it's a command-line OpenPGP tool, describes
the various things it can do, and references some comparable
implementations (so people can find it if they search for GnuPG or gpg)

Can you say a little bit more about what you would prefer it to say
instead?

It looks like the description we have today was written when sq was
first packaged, but wasn't actually incorporated into the package
until later because of https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993633

Version 0.25.0-1 simply had

As far as the current description goes, I think it's generally not
too bad but I think there are some minor improvements that could be
made.

* It would be nice if we could get rid of the last couple of lines
   (which are generated by debcargo) somehow since they are largely
   redundant. Not sure if this is possible with current debcargo.
* I feel it lacks a bit in "big picture", I *think* sqv is the main
   command line tool for the sequoia project. If that is the case
   it would be nice to say so expliciltly and upfront. Also since
   people will be comparing it with gpg it might be an idea to point
   out explicitly whether things like web of trust support are
   included.
* I'm not sure a list of subcommands belongs in a package
   description or if the description would be better sticking
   to describing functionality.

That's correct. I think now the description makes sense, and I like the
improvements you propose.


Enrico

Hi!

[…]

The main CLI is sq. The sqv CLI is intended to be the equivalent
of gpgv, as in a verification only tool, where the full blown thing is
not necessary.

AFAIK there's a separate sq-wot tool for this. Other related
projects include sq-keyring-linter and sqop, or even the GnuPG
Chameleon, or openpgp-cert-d among others.

Given that the CLI is still in flux, I guess for now it might be
helpful, but perhaps a more descriptive one might be better, dunno.

Thanks,
Guillem