{"id":"openSUSE-RU-2026:21658-1","summary":"Recommended update for sequoia-sq","details":"This update for sequoia-sq fixes the following issues:\n\nChanges in sequoia-sq:\n\n- Legal review Change main license to LGPL-2.0-or-later from GPL-2.0-only\n  * LICENSE.txt confirms it\n  * Correct Legal-Review-Notice usage\n\n- Update dependencies due to security issues (CVE-2026-25541 bsc#1274437)\n\n- Switch crypto backend from nettle to openssl (bsc#1257934)\n\n- Update to version 1.4.0:\n  * Release v1.4.0.\n  * Update crossbeam-epoch.\n  * Enable optimizations when building rust-crypto crates.\n  * tool: canonicalize Ord and PartialOrd impls for Association\n  * tool: silence clippy error for potentially mutable Map key types\n  * tool: fix formatting to avoid leaking comments into doc strings\n  * clippy: allow two types with interior mutability for BTreeSet keys\n  * lib: avoid potentially panicking integer cast\n  * clippy: add default lint configuration\n  * Update NEWS.\n  * lib: Improve control char escaping\n  * tool: Fix output file's permissions.\n  * Gracefully deal with 404 HTTP result codes\n  * tool: Don't panic if write fails\n  * tool: Restrict file permissions on sensitive output\n  * Improve temporary file handling.\n  * Forward allow-* crypto features.\n  * Relax rusqlite dependency.\n  * tool: Add more cipher suites.\n  * tool: Add sq key generate --{encryption,signing}-algorithm.\n  * Update Cargo.lock.\n  * Relax subplot dependency.\n  * Relax roff dependency.\n  * Relax toml_edit dependency.\n  * Upgrade sequoia-wot.\n  * Relax indicatif dependency.\n  * Relax gethostname dependency.\n  * Relax dirs dependency.\n  * Relax clap_lex dependency.\n  * Update Cargo.lock.\n  * meta: Bump MSRV to 1.85.\n  * Update signing policy.\n\n- Update vendored dependencies due to security and build issues\n\n- Update to version 1.3.1:\n  * Release 1.3.1.\n  * Fix formatting.\n  * Improve documentation of `sq config`.\n  * Emit hints to mark an imported key as authenticated or introducer.\n  * Hedge against importing keys into the cert store.\n  * Improve displaying of preferred user IDs.\n  * Fix typo.\n  * Display backtraces attached to errors.\n  * tests: Avoid DSA key in tests as DSA will be rejected in the future.\n  * tests: Update PKI test vectors to not expire.\n  * Enable backtraces and tracing when running tests.\n  * Make importing Autocrypt certs more robust.\n  * Release 1.3.0.\n  * Make sq config get print to stdout.\n  * Fix early abort in sq keyring filter\n  * Fix test sq_verify_policy_as_of_relative_time\n  * Fix error message.\n  * Prefix matching for --...-self parameters fixed\n  * Fix examples.\n  * Port to sequoia-openpgp 2.\n  * ci: Always build the pages, but only publish when merging to main.\n  * Upgrade sequoia-man.\n  * Split out the man page generation into a new crate.\n  * Update openssl to address RUSTSEC-2025-0004.\n  * Update hickory-proto to address RUSTSEC-2025-0006.\n  * man: Fix NAME section for subcommands.\n\n- Update to version 1.2.0:\n  * Release 1.2.0.\n  * Update Cargo.lock.\n  * Use authenticated identifiers in sq verify.\n  * Improve quoting.\n  * Improve sq download's output.\n  * Add a parameter to the authenticate function to control the output.\n  * Move helper function to common.\n  * Add a mechanism to replace an argument in a hint with a placeholder.\n  * Avoid crash parsing arguments to Strings.\n  * Make sq cert lint less quiet when there are no issues.\n  * Add sq key rotate.\n  * Extend replay to optionally take a signer.\n  * tests: Move utility function to the common module.\n  * Move function to the common module.\n  * Extend replay to allow the caller to limit what is replayed.\n  * Improve output.\n  * Allow the caller to specify an indentation level.\n  * Disable tracing.\n  * Fix test helper function.\n  * Add sq pki vouch replay.\n  * Move certification listing code to the common module.\n  * Move code in common to the sole function that uses it.\n  * Move the sq pki link list implement to its own module.\n  * Extend sq pki vouch list to list certifications of a certificate.\n  * Improve test.\n  * Simplify specifying certificate designators in tests.\n  * Require that certificate designators are authenticated.\n  * Use an explicit type for the trust amount parameter.\n  * Fix sq --cli-version.\n  * Improve sq pki link list's help text.\n  * Improve error messages.\n  * Avoid unnecessary lookups.\n  * Relax sq pki link list's certificate designators.\n  * Fix examples.\n  * Don't export non-exportable sigs and components when exporting keys.\n  * Add missing NEWS entry.\n  * Fix duplicating packets when dumping.\n  * Prevent monomorphization of Sq::resolve_cert.\n  * Prevent monomorphization of Sq::resolve_certs_filter.\n  * Add new command sq pki vouch list.\n  * Move the code for listing certification to common.\n  * Release 1.1.0.\n  * Relax subplot dependency.\n  * Relax rusqlite dependency.\n  * Update Cargo.lock.\n  * Fix output.\n  * Add a lint for uncertified user IDs.\n  * Show certificates without user IDs with --gossip.\n  * Improve sq cert list's documentation.\n  * Improve help text lints.\n  * Fix long help generation for cert designators.\n  * Update NEWS file.\n  * Add option --unusable to sq cert list, etc.\n  * Show hints about unusable bindings when --gossip is provided.\n  * Change how we refer to unusable bindings in sq cert list.\n  * Change sq cert list to not show warnings if --quiet is given.\n  * Distinguish unauthenticated and invalid bindings in sq cert list.\n  * Improve linting for sq cert list.\n  * Don't list revoke user IDs.\n  * Fix listing certificates by fingerprint or key ID.\n  * Remove duplicate code.\n  * Rework sq cert list's human readable output.\n  * Improve UserIDDesignator::argument_value.\n  * Fix UserIDDesignator::argument_value.\n  * Add some helper functions.\n  * tests: Add tests for sq cert list.\n  * Fix sq cert list --gossip.\n  * Fix output.\n  * Release 1.0.0.\n  * Fix NEWS.\n  * Align `sq download` with `sq verify`.\n  * Fix displaying preferred user IDs.\n  * Write to temporary file first, then persist it under the final name.\n  * Avoid using absolute paths in name of scratch files.\n  * Automatically import certificates from GnuPG's certificate store.\n  * Escape user IDs.\n  * Escape preferred keyserver and policy URI.\n  * Escape notation name and data.\n  * Escape literal data file name and data prefix.\n  * Escape all regular expressions.\n  * Escape all reason for revocation messages.\n  * Improve output sanitization.\n  * Use the visual idiom for cert,userid pairs authenticating downloads.\n  * Use the visual idiom for cert, userid pairs when decrypting.\n  * Use the visual idiom for cert, userid pairs when importing revs.\n  * Use the visual idiom for cert, userid pairs when certifying.\n  * Improve argument and value formatting in hints.\n  * Improve help output.\n  * Revert \"Refine sq pki {authenticate,lookup}'s user ID designators.\"\n  * Fix commands embedded in the documentation.\n  * Make verifying detached signatures more efficient.\n  * Require sequoia-openpgp 1.22.\n  * Fix hint.\n  * Refine sq key userid revoke's user ID designators.\n  * Refine sq pki vouch {add,authorize}'s user ID designators.\n  * Refine sq pki {authenticate,lookup}'s user ID designators.\n  * Refine sq pki link retract's user ID designators.\n  * Refine sq pki link {add,authorize}'s user ID designators.\n  * Add sq pki path --userid-by-email.\n  * Gracefully handle unencrypted Autocrypt messages.\n  * Align output emitted when importing certificates.\n  * Don't unconditionally show provenance messages.\n  * Fix importing unencrypted Autocrypt messages.\n  * Improve error handling opening the cert store.\n  * Do not hide errors from keyrings in verify.\n  * Refactor packet and keyring files in /cli to new example framework.\n  * Refactor files in /cli/network to new example framework.\n  * Refactor files in /cli/pki to new example framework.\n  * Refactor files in /cli to new example framework.\n  * Remove the unstable CLI warning.\n  * Don't make impossible recommendations.\n  * Remove useless code.\n  * Disable the --name and --add-name arguments.\n  * Rename --userid-or-add to --add-userid, etc.\n  * Extend and adjust the set of user ID designators.\n  * Refactor the user ID designators.\n  * Update all dependencies.\n  * Fix test.\n  * Trim unused features on sequoia-cert-store.\n  * Update sequoia-net and reqwest.\n  * Add argument `sq network search --iterations`.\n  * Add argument `sq network search --use-dane`.\n  * Add argument `sq network search --use-wkd`.\n  * Better handle user ID's matched by --all.\n  * Make --all conflict with other user ID designators.\n  * Fix test for sq pki link retract.\n  * Make `sq cert list` display certificates without user IDs.\n  * Prepare for userid-less certificates in common::pki::authenticate.\n  * Split OutputFormat::add_paths into two functions.\n  * Fix listing certificates without authenticated bindings.\n  * Apply the input lints to all certs.\n  * Only show hints about an empty cert store if it is indeed empty.\n  * Change `sq config inspect policy` to explain the policy.\n  * Fix warnings about elided lifetimes that have a name.\n  * Add tests for sq key approvals update.\n  * tests: Improve sq key approvals update help functions.\n  * Add tests for sq key approvals list.\n  * Add tests for sq key userid revoke.\n  * Add tests for sq pki lookup.\n  * Add tests for sq pki authenticate.\n  * Add tests for sq pki vouch {add,authorize}.\n  * tests: Rename Sq::pki_vouch_authorize_p.\n  * tests: Simplify Sq::try_pki_vouch_add and Sq::pki_vouch_authorize_p.\n  * Add tests for sq pki link retract.\n  * Add tests for sq pki link authorize.\n  * Add tests for sq pki link add.\n  * Simplify comments.\n  * Lint CLI help texts.\n  * Align CLI help texts with our UI guidelines.\n  * Make long help texts configurable for cert designators.\n  * Deduplicate and rework the signature notation argument handling.\n  * Require explicit opt-out for encrypting without signing.\n  * Use cert designators for `sq cert list`.\n  * Add examples for `sq cert list`\n  * Refactor files in /cli/cert to new example framework\n  * Modify examples\n  * Refactor files under .../cli/key to use example framework\n  * Fix generation of user ID-less keys.\n  * Upgrade hickory-proto to avoid vulnerable idna 0.4.0.\n  * Gracefully handle missing ui section in config file.\n  * Add `sq encrypt --profile` in preparation for RFC9580.\n  * Add `sq key generate --profile` in preparation for RFC9580.\n  * Parse key.generate.cipher-suite case sensitively.\n  * Mention the configuration key in the augmented help texts.\n  * Make `sq network dane generate` require cert designators or `--all`.\n  * Make `sq pki link list` fail if a designated cert has no link.\n  * Refactor user ID matching when resolving certificates.\n  * Generalize the filter for `Sq::resolve_certs_filter.\n  * Align `sq sign --detached-file` with `sq verify --detached-file`.\n  * Make the default third-party certification expiration configurable.\n  * Introduce a specialization for third-party certifications.\n  * Make ExpirationArg configurable.\n  * Manually implement clap::Args for ExpirationArg.\n  * Add tests for sq pki link list.\n  * Add tests for sq key list.\n  * Listing an empty certificate store should not be an error.\n  * Fix hint.\n  * Hide --without-password from the sq key generate examples.\n  * Make it possible to hide parts of an example.\n  * Change the default third-party certification expiration to 10y.\n  * Implement `sq pki vouch {add,authorize} --certifier-self`.\n  * Improve the `--self-signer` help texts and add to the template.\n  * Add a pattern argument to `sq pki link list`.\n  * Add missing conflict for `sq key list`.\n  * Change sq config inspect network to use stdout.\n  * Change sq config inspect paths to use stdout.\n  * Change sq cert import and sq key import to use stdout.\n  * Improve sq network wkd publish's output.\n  * Change sq network wkd publish to use stdout.\n  * Convert a hint to a warning.\n  * Change sq network keyserver publish to use stdout.\n  * Change sq pki link add, etc. to use stdout.\n  * Generalize make_qprintln to write to a different stream.\n  * Change sq pki link list to use stdout.\n  * Before printing a hint, flush stdout.\n  * Change sq cert list, sq pki authenticate, etc. to use stdout.\n  * Generalize the authentication output routines to use any stream.\n  * Change sq key approvals list to use stdout.\n  * Change sq key list to use stdout.\n  * Add new macro wwrintln.\n  * Generalize weprintln and iweprintln to write to any stream.\n  * Rename wprintln to weprintln.\n  * Clean up sq key list's output.\n  * Implement `sq config inspect network`.\n  * Implement `sq config inspect paths`.\n  * Implement `sq config inspect policy`.\n  * Make `sq key list` fail without key store, align error messages.\n  * Align error messages when listing certs.\n  * Import the secret key so that the example has something to list.\n  * Change sq inspect to show the cert associated with a recipient.\n  * policy: Update certificates.\n  * Simplify code.\n  * Remove unreachable code.\n  * Fix resolving `--signer-self`.\n  * Improve formatting of message.\n  * Implement `sq sign --signer-self` and `sq encrypt --signer-self`.\n  * Make the number of iterations configurable for `sq network search`.\n  * Make use of DANE configurable when doing `sq network search`.\n  * Make use of WKD configurable when doing `sq network search`.\n  * Make the path to the backend servers configurable.\n  * Fix displaying effective configuration.\n  * Make hints configurable.\n  * Generalize function.\n  * Make verbosity configurable.\n  * Introduce accessors for sq.quiet and sq.verbose.\n  * Use platform-specific prompt in hints.\n  * Indent hints so that they look different from shell prompts.\n  * Improve the `--for-self` encryption hint.\n  * Don't show hint if a recipient is listed in encrypt.for-self.\n  * Don't explicitly create `Recipient`s.\n  * Show the configuration file's location in sq config --help.\n  * Fix message.\n  * Display a hint if encrypting a message that one can not decrypt.\n  * Implement `sq encrypt --for-self`.\n  * When encrypting a message, list signers.\n  * When encrypting a message, list recipients and passwords.\n  * Use BufferedReader::copy to avoid an extra copy.\n  * Rework encryption subkey selection.\n  * Fix handling of `--home=default` and `--home=none`.\n  * Drop superfluous mut.\n  * Align user ID designators in `sq pki link retract`.\n  * Add support for addressing shadow CAs by symbolic names.\n  * Make `sq config get policy.path` reflect SEQUOIA_CONFIG_POLICY.\n","modified":"2026-08-27T18:23:35.458394230Z","published":"2026-08-25T18:07:43Z","related":["CVE-2026-25541"],"upstream":["CVE-2026-25541"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1257934"},{"type":"REPORT","url":"https://bugzilla.suse.com/1274437"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-25541"}],"affected":[{"package":{"name":"sequoia-sq","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/sequoia-sq&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"sequoia-sq-fish-completion":"1.4.0-bp160.1.1","sequoia-sq-zsh-completion":"1.4.0-bp160.1.1","sequoia-sq":"1.4.0-bp160.1.1","sequoia-sq-bash-completion":"1.4.0-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-RU-2026:21658-1.json"}}],"schema_version":"1.9.0"}