Sign your logs and upload them to ARRL's Logbook of The World (LoTW), with your private key kept by your computer's own credential store (macOS Keychain, Windows Credential Manager, the Linux Secret Service) rather than in a file.
QGT is an alternative to TQSL, built on enterprise engineering practice: a memory-safe
implementation, keys held by the OS, and every behaviour proved by tests against TQSL itself. It
reads the certificates and files TQSL uses, and the loggers that call tqsl today can call QGT the
same way.
Status: in development, not yet usable. QGT signs nothing yet. It is planned to ship with QSO Graph Desktop 0.7.0; the work and its gates are tracked in qso-graph-desktop#169.
| Part | What it does | Where |
|---|---|---|
| The library | Certificates, station locations, signing, upload and duplicate tracking. Shared by everything below | crates/qso-graph-trust |
qg-trust, the command line |
tqsl-compatible options, exit codes and status line, for loggers and scripts | crates/qso-graph-trust-cli |
| QSO Graph Desktop | QG Trust's interface: an extension, using the library (decision 0005) | qso-graph-desktop |
| Phase | Done when | Issue |
|---|---|---|
| 1 Foundation | CI green on Windows, macOS and Linux; the no-C and no-unsafe checks proved by planted cases | #170 |
| 2 Signing core | Byte-identical to tqsllib on LoTW's 1024-bit keys, with and without a password | #171 |
| 3 The library | All 220 tqsllib functions mapped and tested; fuzzing clean; the key found nowhere it shouldn't be | #172 |
| 4 CLI tools | Loggers' real calls behave the same; LoTW processes the uploads | #173 |
| 5 QSO Graph Desktop extension and packaging | Signed packages on three platforms | #174 |
With Rust installed (rustup installs the version rust-toolchain.toml names):
cargo test --workspace
cargo xtask policy # no C in the library, no unsafe code
cargo run -p qso-graph-trust-cli -- --versionQSO Graph Trust stands on other people's work.
TrustedQSL (TQSL) and the people who built it and keep it running. TQSL's contributors, as its
AUTHORS.txt lists them, are WA1GON, K1MK, KE3Z, K1MU, KC2YWE and AA6YQ, with ARRL. Since 2003 their
work has carried the signature on every QSO confirmed through Logbook of The World: a signing format, a
certificate system and a program that hams on every platform rely on, kept current through two decades of
operating systems, library changes and new modes, as volunteers. Thank you.
ARRL, for LoTW itself and for documenting it for developers.
rfrht's qso-web, which showed, with a shell script and OpenSSL, that
a .tq8 built without TQSL is one LoTW accepts.
QG Trust is a ground-up rewrite in Rust, not a method-by-method port of TQSL. What it does was decided from these, and how is QG Trust's own:
- ARRL's LoTW developer documentation: developer information,
the signed log,
.tq8, submitting QSOs, LoTW's PKI, certificate security, station locations, TQSL's command line, and the LoTW Trusted Partners guidelines. - TrustedQSL: its source at v2.8.7, read for what LoTW
receives; tqsllib's API documentation; and
TQSL's change log. QG Trust carries two things of
TQSL's, both ARRL's, under ARRL's terms: the TQSL configuration (
config.xml), from which the LoTW tables are generated, and ARRL's root and CA certificates as TQSL embeds them. TQSL 2.8.7, built from its own source, is the reference every signature QG Trust makes is tested against, byte for byte. - Other open-source projects: qso-web, above, and a survey of 126 ham-radio Rust crates on crates.io (qso-graph-devel#112), which found no other LoTW signing crate.
- Standards: ADIF 3.1.7; RFC 5280 (X.509 certificates), RFC 4055 and RFC 8017 (RSA), RFC 1952 (gzip); W3C XML 1.0.
How QG Trust compares with TQSL, feature by feature, and what it will and won't do:
docs/FEATURE-PARITY.md.
GPL-3.0-only (LICENSE); see NOTICE. QGT is not made or endorsed by ARRL. "Logbook of The World", "LoTW" and "TQSL" are ARRL's names, used here only to say what QGT works with.