λgitsite

~ober/jerboa-pgp

Imported from ~/mine/jerboa-pgp

download snapshot

about

# jerboa-pgp

A modern, friendlier file crypto tool, written in [Jerboa] with a pure-Rust
crypto backend. **No C dependencies.**

```
jpg keygen
jpg encrypt -r alice.pub.jpgp -i secret.txt -o secret.txt.age
jpg decrypt -i secret.txt.age
jpg sign -i release.tar.gz -o release.tar.gz.sig
jpg verify release.tar.gz.sig -i release.tar.gz --pubkey release-signer.pub.jpgp
```

Native crypto is [age]-style (X25519 + ChaCha20-Poly1305) for encryption and
Ed25519 for signing.

OpenPGP/GnuPG interop is disabled in production builds. The Rust OpenPGP
backend currently pulls an unfixed `rsa` RustSec advisory, so this repo fails
closed and rejects OpenPGP armor until a clean dependency graph is available.

## Status

v1 implements:

- `keygen` / `pubkey` / `list` / `fingerprint` (SSH-style `SHA256:`)
- `encrypt` / `decrypt` (age, multi-recipient, symmetric)
- `sign` / `verify` (Ed25519 native)
- Self-contained `jpg-bin` (Chez `compile-program` + boot-embedded)
- Strict native dependency audit with `cargo audit -D warnings`

See [`docs/`](docs/) for the architecture, FFI surface, on-disk
formats, disabled interop decision, build internals, and threat model.
[`PLAN.md`](PLAN.md) is the original design sketch.

## Why

GPG has been around for two decades and almost nobody uses it. The data
model, the CLI surface, and the agent socket dance make it practically
inaccessible. `jerboa-pgp` keeps the *use cases* of GPG and discards
its *artifacts*.

- **One identity file, one passphrase.** No keyring directory, no agent.
- **Recipients are public-key strings**, not email addresses. Paste them
  into Slack like an SSH key.
- **Pure Rust crypto, no C.** `age`, `ed25519-dalek`, `zeroize`.
- **Jerboa for the human side.** CLI parsing, file I/O, formatting.

## Build

Requires Rust/Cargo and Jerboa. `make test` and `make run` use `jerbuild`;
if no local Jerboa checkout/tool is available, CI installs the pinned release
toolchain with `support/ensure-jerboa.sh`.

```
make run ARGS='version'   # interpreter mode
make test                 # smoke tests
make audit                # cargo-audit for the Rust backend
make test-interop         # reports OpenPGP interop disabled/skipped
make binary               # native `jpg` binary (5MB Mach-O / ELF)
make release-evidence     # tests, audit, SBOM, reproducibility
make install              # → ~/.local/bin/jpg (native crypto is linked in)
```

Release evidence is documented in
[`docs/release-evidence.md`](docs/release-evidence.md), with dependency
provenance in [`docs/dependency-provenance.md`](docs/dependency-provenance.md).
The release gate fails closed on RustSec advisories, secret-scan findings,
test failures, or reproducibility mismatches.

## Interop with gpg

OpenPGP interop is currently rejected. See [`docs/INTEROP.md`](docs/INTEROP.md)
and [`docs/dependency-provenance.md`](docs/dependency-provenance.md) for the
release decision.

## License

Apache License 2.0.

[Jerboa]: https://git.jerboa.sh/ober/jerboa
[age]: https://github.com/FiloSottile/age

recent commits