Ubuntu 26.10 Will Offer a Rust-based GnuPG Replacement Option (itsfoss.com)
(Saturday October 10, 2026 @11:34PM (EditorDavid)
from the Ubuntu's-encrypting dept.)
- Reference: 0186096252
- News link: https://linux.slashdot.org/story/26/10/10/2155227/ubuntu-2610-will-offer-a-rust-based-gnupg-replacement-option
- Source link: https://itsfoss.com/news/ubuntu-sequoia-pgp-inclusion/
[1]The blog It's FOSS reports :
> You already know that Canonical has been selectively [2]replacing Ubuntu's C-based system [3]components with [4]Rust-written equivalents that don't compromise in terms of functionality, most of the time. Now it looks like the distro's OpenPGP implementation is next, with Sequoia PGP coming preinstalled in Ubuntu 26.10. Canonical wants it to eventually replace GnuPG [the dominant Linux implementation of PGP, written in C] as the default toolchain, though that switch has not happened yet... [The Ubuntu 26.10 [5]release notes say Sequoia PGP's default status will be a future goal...]
>
> [Sequoia PGP] was started in 2017 by three former GnuPG developers who chose to build a new OpenPGP implementation in Rust rather than keep evolving GnuPG's existing codebase. [6]Sequoia PGP is designed as a library that other software can use directly, rather than a standalone command-line tool. sq sits on top of that for encryption, decryption, signing, and key management, and sqv handles signature verification, filling in for gpg and gpgv in GnuPG.
>
> Sequoia also implements [7]RFC 9580 , the 2024 revision of the OpenPGP standard, whereas GnuPG has continued from the RFC 4880 branch, pursuing its own newer extensions and the LibrePGP specification rather than adopting RFC 9580 as its primary standard.
From the [8]It's FOSS Weekly newsletter , which also notes that the founder of the It's FOSS blog has also created a Linux-themed game called [9]TUXDLE — a variation on Wordle where all the answers are Linux terms.
[1] https://itsfoss.com/news/ubuntu-sequoia-pgp-inclusion/
[2] https://news.slashdot.org/story/25/11/01/079206/ubuntu-will-use-rust-for-dozens-of-core-linux-utilities
[3] https://news.slashdot.org/story/25/05/06/213254/memory-safe-sudo-to-become-the-default-in-ubuntu
[4] https://news.slashdot.org/story/26/09/15/2115242/ubuntus-rust-ification-hits-new-milestone-coreutils-migration-is-complete
[5] https://documentation.ubuntu.com/release-notes/26.10/?ref=itsfoss.com#an-oxidized-openpgp
[6] https://sequoia-pgp.org/
[7] https://www.rfc-editor.org/rfc/rfc9580.txt?ref=itsfoss.com
[8] https://itsfoss.com/newsletter/foss-weekly-26-41/
[9] https://tuxdle.com/
> You already know that Canonical has been selectively [2]replacing Ubuntu's C-based system [3]components with [4]Rust-written equivalents that don't compromise in terms of functionality, most of the time. Now it looks like the distro's OpenPGP implementation is next, with Sequoia PGP coming preinstalled in Ubuntu 26.10. Canonical wants it to eventually replace GnuPG [the dominant Linux implementation of PGP, written in C] as the default toolchain, though that switch has not happened yet... [The Ubuntu 26.10 [5]release notes say Sequoia PGP's default status will be a future goal...]
>
> [Sequoia PGP] was started in 2017 by three former GnuPG developers who chose to build a new OpenPGP implementation in Rust rather than keep evolving GnuPG's existing codebase. [6]Sequoia PGP is designed as a library that other software can use directly, rather than a standalone command-line tool. sq sits on top of that for encryption, decryption, signing, and key management, and sqv handles signature verification, filling in for gpg and gpgv in GnuPG.
>
> Sequoia also implements [7]RFC 9580 , the 2024 revision of the OpenPGP standard, whereas GnuPG has continued from the RFC 4880 branch, pursuing its own newer extensions and the LibrePGP specification rather than adopting RFC 9580 as its primary standard.
From the [8]It's FOSS Weekly newsletter , which also notes that the founder of the It's FOSS blog has also created a Linux-themed game called [9]TUXDLE — a variation on Wordle where all the answers are Linux terms.
[1] https://itsfoss.com/news/ubuntu-sequoia-pgp-inclusion/
[2] https://news.slashdot.org/story/25/11/01/079206/ubuntu-will-use-rust-for-dozens-of-core-linux-utilities
[3] https://news.slashdot.org/story/25/05/06/213254/memory-safe-sudo-to-become-the-default-in-ubuntu
[4] https://news.slashdot.org/story/26/09/15/2115242/ubuntus-rust-ification-hits-new-milestone-coreutils-migration-is-complete
[5] https://documentation.ubuntu.com/release-notes/26.10/?ref=itsfoss.com#an-oxidized-openpgp
[6] https://sequoia-pgp.org/
[7] https://www.rfc-editor.org/rfc/rfc9580.txt?ref=itsfoss.com
[8] https://itsfoss.com/newsletter/foss-weekly-26-41/
[9] https://tuxdle.com/
"option" (Score:2)
by Gravis Zero ( 934156 )
This is how it starts, an option... right up until they steamroll you by making it mandatory and a dependency. I recall how systemd was "optional" until it suddenly wasn't.
Re: (Score:1)
by drnb ( 2434720 )
> This is how it starts, an option... right up until they steamroll you by making it mandatory and a dependency.
So Rust is the new Ada? :-;
This is about actual standards (Score:2)
by CommunityMember ( 6662188 )
GnuPGs divergence from (rejection of) the IETF standards means you have to choose a side (agree with the standards, or go this other way). I wish GnuPG had chosen to follow the standards, in which case, let the best implementation win, but now that only one implementation follows the standard, there is no real choice.
What can possibly go wrong (Score:1, Interesting)
Replace a long proven security program used for the most essential functions of the operation system by a clone written in rust.
People, you are signing you fucking packages with PGP. Using some rust clone just because is a catastrophe waiting to happen. When the replacement got 20 years of stable releases without major bugs, you can start considering to use it. Until then, stick to the proven solution. What's next, rewriting gnutls in rust and hoping the best? There is so much things that you can fuck up wi
Re:What can possibly go wrong (Score:4, Informative)
Hi. Um, I'm not sure you really need me to weigh in here, but... no. There isn't anybody who's paid to promote Rust or AI at Slashdot. So no one is trying to create "social media buzz."
Rust is being added to lots of major projects in the Linux world, even including the Linux kernel. So that's newsworthy. (And it's definitely not fake.) Maybe some people want to wish that away -- but taking a deep breath and saying "fake news" real loud won't make that happen.
Also, we aren't assholes. And the site is not fucking gay now. (I'm not even sure how you're measuring that...)
Re: (Score:3)
you're an old and bitter man, and you've only yourself to blame
and I'm old too and a loooong time c++ professional dev (and still am) and somehow the idea of change or the word 'Rust' doesn't make me shit my pants
I feel bad for you
Needs license chnage too (Score:2)
Going back to the rewrite of smaller Linux related tools in Rust instead of keeping C versions. We can have both when warranted.
It would be better to switch to a MIT type license instead of rewriting and picking a GPL license.
Re: (Score:2)
I don't think it's a good idea, but not for the reason you probably think .
Having multiple implementations of a de-facto standard library is basically forking. And forking is not a good thing, by and large.
It creates product redundancy while also introducing subtle differences among the forks, which both destroys the previous standard and is bad for interoperability.
Forking also splits the community into us vs them, and brings uncertainty to users who don't know which library to use. In the worst case o
Re: (Score:2)
Then how to rewrite anything in another language?
They would run in parallel for some time, right?
Re: (Score:2, Insightful)
Rust is the future of code old man
Re: (Score:2)
Then I guess it's good I'm going to retire in ~5 years. I haven't used C professionally for larger programs in some years (just small ones), but I still remember it well enough from the 10 years that I did that I can look at a C program and know what's doing in fairly short order. By changing programs/libs to Rust, you're limiting the number of people who can/will work on OSS projects, as I and I'm sure others don't know Rust and have no plans to pick it up.
There are a number of other tasks I can do for OSS