Written by Rust, the RPM package manager in Fedora 38 will be changed from OpenPGP to Sequoia

CTOnews.com, December 1, the Fedora release has had its own OpenPGP parser handle the keys and signatures of the package for the past 20 years. However, in the upcoming Fedora 38 release, the development team plans to use "Sequoia" written by Rust as the RPM package manager.

The development team said in an announcement that it doesn't make much sense to continue to maintain their own OpenPGP parsers after a better parser has emerged. Upstream RPM has been trying to abolish internal parsers and use Sequoia PGP instead. CTOnews.com learned that Sequoia PGP is an OpenPGP library written in Rust with a focus on security and correctness in its design principles.

Fedora developers are eager to port Sequoia PGP to the RPM and want to see it all ready in Fedora 38. Switching to the correct OpenPGP parser should lead to better security and standards compliance.