Anyone setup Sequoia-PGP?

User Support
,
1

I was reading up on split-gpg2 and I came across this topic where @adrelanos recommends Sequoia-pgp. My curiosity can’t let something like that pass by, especially with the known security issues with gpg. The linked topic didn’t really develop, and I’m fishing for opinions other than the links in that topic.

I wanted to ask you guys if your workflow uses this, and how it compares with gpg2 from a user standpoint. Do i get it right in thinking it’s split-gpg2 with additional packages?

The last release of the cli interface (sequoia-chameleon-gnupg) is from March last year, as far as I can see. There looks to be a whole bunch of packages to install, and some elements to be sorted (–export-secret etc).

I’ll guess it’s too early for porting user documentation from GnuPG to Sequoia-PGP?

kicksecure-18 template is available.

How about this? Does it work out?

2

In some ways, this is a bump of a post I made some weeks back regarding Sequoia that didn’t attract any responses. Since that, my understanding of it has grown somewhat, especially with the really cool resources available at Sequoia.

However, my question list continues to grow and I’m hoping some members can guide me, especially @adrelanos and @xyhhx since they have firsthand knowledge of its setup, but saying that, I’m cool with any input.

This guide by @xyhhx looks like a good place to start, but I’ve always avoided installations in dom0, while the first step in this guide is to do just that (split-gpg2-dom0), to allow VMs to communicate on the basis of created tags. Sounds like a nice idea, but I wanted to check-in with you guys before overriding all my previous caution.

Then of course there’s the official docs to setup split-gpg2. Create template + VMs and Policy for VMs. Looks easy-peasy. Is it possible to adapt this to include sequoia-sq and sequoia-chameleon-gnupg(gpg-sq) to create symlinks that allow gpg2 commands to point to gpg-sq? What incompatibilities still exist between gpg-sq and split-gpg2? I also read that keystores are handled very differently; I’d probably need guidance on that point too.

In addition, in the Qubes Global Config the qubes.Gpg is used while in the official doc qubes.Gpg2 policy is used, and there’s no reference to Global Config in the official guide. Is this documentation up to date?

And lastly (for now :slightly_smiling_face: ), would it be better do create one split for gpg2 and one for gpg-sq so I’m not dependent on a single tool? Especially until newer key types / messages (such as “LibrePGP/v5” paths) are more mainstream? Old habits and old tools die hard for most people.

Anyway, I’m sure there’s way, way more for me to explore and understand on this, and I’d very much appreciate any input you have. Sorry for spamming you with so many questions. My curiosity doesn’t want to let go of it all, so the sooner I get it out of my head and working the better I’ll feel :slightly_smiling_face:

3

Mods, please merge the threads.

When you comment on a post, it is bumped to latest, no need to open a separate post. I did see your previous post, but didn’t have the time at that moment.

The package just contains Qrexec policies, nothing dangerous there.

The qubes.Gpg2 refers to split-gpg2. The Global Config doesn’t support that yet.

This answer is not easy to gather. If you worry about compatibility, use the official guide.

The best thing would be to have a working setup first, so, forget about the chameleon for a moment. Try to get it working with the official guide rather than third party guides. If you get that working, great, now you might be ready to start experimenting with the chameleon.

4

Note: I have an interest for this topic so I have read your post, but next time use @moderators if you need us to merge something, or flag it.

5

This is a frequently asked question about Split GPG-2, because of user guides (or official instructions?). We could add a little FAQ in the docs?

Do I need to install split-gpg2-dom0?

Short answer: no. split-gpg2-dom0 will only install some python tests for development purpose and a policy file with comments only. You can install it but it will be probably useless.

I haven’t been able to run the usual dnf commands to recheck this one more time… Is split-gpg2-dom0 still a thing?

See:

Edit: and, don’t forget, this is Qubes OS: you can create/clone some qubes, install things, check if it works, revert to previous volumes and so on. A real playground!

6

Many thanks for the housekeeping. Yes, I’ll pay attention to a separate post creation in future. Or not mention “bump” :slightly_smiling_face:

Please note that my reference to split-gpg2-dom0 only applies to the linked guide setup by @xyhhx to create a tag system for VMs to communicate. I don’t find it at all in the Qubes documentation, so it’s definitely not a thing in that context. I’d missed the posts describing it as redundant, so many thanks for that. If it’s unnecessary in the xyhhx guide, I’d be happy to learn about an alternative policy.d approach to fit that guide in 4.3. On the other hand, if it’s harmless to dom0 as @ben-grande mentions, I’m also cool with that.

Agreed, but I also see no problem with the split-gpg2 setup in the official guide. Seems easy enough (I’d hope), and there’s plenty of experience with it from forum members. It’s the step to integrate Sequoia I’d like to gain confidence with, and up to now the only guide I can find for that next step is the linked guide I refer to.

I’d still like to highlight my ask regarding if the official guide to split-gpg2 can be adapted to include sequoia-sq and sequoia-chameleon-gnupg(gpg-sq) to create symlinks that allow gpg2 commands to point to gpg-sq.

Amen :slightly_smiling_face:

Many thanks for your input thus far (and the housekeeping). Much appreciated.

7

Yes, I know but this package is mentioned in several places. I’m pretty sure I installed it myself too while discovering Split GPG 2. So that could be good to be clear about that in the official docs?

This is covered by the 2nd item of the dom0 section in the guide by @xyhhx and tags are added a bit later.

I don’t see any mention of that in the guide? Also, some context:

8

This is fine. Though, I wish the guide was a thin as possible, but I understand that users are asking this question…

No need to install it indeed.

Yes. If someone contributes. Definitely not a replacement for GPG on split-gpg2 at this stage because Sequoia doesn’t provide an agent yet, just ways of interacting with it, this is the reason the guide is limited to have key generation and usage in Sequoia, but the keys are stored in gpg-agent. The guide also needs to support the oldest template we provide, which is always Debian oldstable.

9

I have considered putting it in the general FAQ but it is only “frequent” in the context of Split GPG 2. A dedicated page for this would be overkill.

I don’t understand. Only Debian 13/stable is listed as supported in the docs.

10

You are right. It is not always Debian oldstable, but for some intervals, it is. For now, only Debian 13 matters.