jerboa-pgp

A modern, friendlier file crypto tool, written in Jerboa with a pure-Rust crypto backend. No C dependencies.

jpg keygen
jpg encrypt -r alice.pub.jpgp -i secret.txt -o secret.txt.age
jpg decrypt -i secret.txt.age
jpg sign -i release.tar.gz -o release.tar.gz.sig
jpg verify release.tar.gz.sig -i release.tar.gz --pubkey release-signer.pub.jpgp

Native crypto is age-style (X25519 + ChaCha20-Poly1305) for encryption and Ed25519 for signing.

OpenPGP/GnuPG interop is disabled in production builds. The Rust OpenPGP backend currently pulls an unfixed rsa RustSec advisory, so this repo fails closed and rejects OpenPGP armor until a clean dependency graph is available.

Status

v1 implements:

• keygen / pubkey / list / fingerprint (SSH-style SHA256:)
• encrypt / decrypt (age, multi-recipient, symmetric)
• sign / verify (Ed25519 native)
• Self-contained jpg-bin (Chez compile-program + boot-embedded)
• Strict native dependency audit with cargo audit -D warnings

See docs/ for the architecture, FFI surface, on-disk formats, disabled interop decision, build internals, and threat model. PLAN.md is the original design sketch.

Why

GPG has been around for two decades and almost nobody uses it. The data model, the CLI surface, and the agent socket dance make it practically inaccessible. jerboa-pgp keeps the use cases of GPG and discards its artifacts.

• One identity file, one passphrase. No keyring directory, no agent.
• Recipients are public-key strings, not email addresses. Paste them into Slack like an SSH key.
• Pure Rust crypto, no C. age, ed25519-dalek, zeroize.
• Jerboa for the human side. CLI parsing, file I/O, formatting.

Build

Requires Rust/Cargo and Jerboa. make test and make run use jerbuild; if no local Jerboa checkout/tool is available, CI installs the pinned release toolchain with support/ensure-jerboa.sh.

make run ARGS='version'   # interpreter mode
make test                 # smoke tests
make audit                # cargo-audit for the Rust backend
make test-interop         # reports OpenPGP interop disabled/skipped
make binary               # native `jpg` binary (5MB Mach-O / ELF)
make release-evidence     # tests, audit, SBOM, reproducibility
make install              # → ~/.local/bin/jpg (native crypto is linked in)

Release evidence is documented in docs/release-evidence.md, with dependency provenance in docs/dependency-provenance.md. The release gate fails closed on RustSec advisories, secret-scan findings, test failures, or reproducibility mismatches.

Interop with gpg

OpenPGP interop is currently rejected. See docs/INTEROP.md and docs/dependency-provenance.md for the release decision.

License

Apache License 2.0.