wiktor, 30 days ago

Based on their Cargo.toml (https://github.com/stalwartlabs/mail-server/blob/e10083651b4bf58d4a78c49f285efac9c5bad4e2/crates/jmap/Cargo.toml#L48) it seems they’re using experimental cryptographic backend which is not "considered mature enough for general consumption": https://gitlab.com/sequoia-pgp/sequoia/-/tree/main/openpgp?ref_type=heads#experimental-and-variable-time-cryptographic-backends

Additionally it looks like they’re not using the recommended way of importing Sequoia: https://gitlab.com/sequoia-pgp/sequoia/-/tree/main/openpgp?ref_type=heads#how-to-select-crypto-backends-in-crates

I don’t have any personal association with Stalwart but maybe it'd be a good idea to report that at https://github.com/stalwartlabs/mail-server/issues ?

👋

kubikpixel, 30 days ago

@wiktor thanks! 👍

nwalfield, 1 month ago

@kubikpixel @stalwartlabs @sequoiapgp They seem to be using Sequoia. https://github.com/stalwartlabs/mail-server/blob/e10083651b4bf58d4a78c49f285efac9c5bad4e2/crates/jmap/Cargo.toml#L48