Add support for Sequoia PGP to depot tools

[jschlatow]

This week, I've spend some time on integrating support for Sequoia PGP to Goa. As most of the adaptations were made in the depot tools anyway, I would like to mirror the changes to the genode repo as well.

[jschlatow]

Sequoia uses gpg-agent as a fallback keystore backend. This means that we can seamlessly transition to using sequoia over gnupg. I've therefor implemented the support in a way that the sq binary is always used if available and compatible (CLI version 1.2.0).

When the required secret key is available in Sequoia's keystore as a softkey, however, Sequoia is not able to cache the password across multiple invocations. There seems to be some sort of a keystore server which is still under development, though. Yet, we can let the depot tool prompt for the password and pass it to each call of sq sign as a workaround. The referenced commit series implements this.

Please note that Sequoia's default policy is more strict when using insecure or expired keys. For instance, it complained about the use of SHA1 in the public keys of @nfeske, @chelmuth and @cproc. In the current implementation, I suppressed this by dating the policy back to before 2013-02-01 but I'd prefer to omit this. Conveniently, Sequoia provides a guide for updating the corresponding keys, which is as simple as calling sq cert lint --fix --cert-file /path/to/pubkey.

I also noted that repos/gems/sculpt/depot/cnuke/pubkey is expired. @cnuke could you fix that?

[jschlatow]

Commit 594e1be removes the expiration date from my pubkey.

[cnuke]

I also noted that repos/gems/sculpt/depot/cnuke/pubkey is expired. @cnuke could you fix that?

Interesting. I already removed the expiration date on my pubkey years ago but apparently the commit never reached the repository.

Commit c4d70c5 updates my pubkey.

[chelmuth]

In 2c95e20, I updated the signatures with gpg like follows. Does this make sq happy?

gpg --cert-digest-algo SHA512 --edit-key <ID>

gpg> uid 1
gpg> expire 0
gpg> save

gpg --armor --export-options export-minimal --output <pubkey file> --export <ID>

[chelmuth]

Ubuntu 24.04 appears to lack a compatible sq package:

error: unexpected argument '--cli-version' found

  tip: a similar argument exists: '--output-version'

> apt policy sq
sq:
  Installed: 0.33.0-3