3

I maintain a small debian repository for my employer, and we have been facing issues lately due to the SHA1 deprecation.

We sign our packages with a 4096bit RSA key. For signing the repository, I used this GPG command:

root@name-not-revealed.com:/var/www/debian/dists/xenial# cat /root/.gnupg/gpg.conf
cert-digest-algo SHA512
digest-algo SHA512
disable-cipher-algo SHA1
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
personal-digest-preferences SHA512

root@name-not-revealed.com:/var/www/debian/dists/xenial# gpg -a --detach-sign \
--personal-digest-preferences SHA512 \
--default-key=XXXXXXXX -o Release.gpg Release 

Checking the signature to make sure it isn't using SHA1:

root@name-not-revealed.com:/var/www/debian/dists/xenial# gpg --list-packets Release.gpg 
:signature packet: algo 1, keyid XXXXXXXXXXXXXXXX
    version 4, created 1484090425, md5len 0, sigclass 0x00
    digest algo 10, begin of digest 3f 00
    hashed subpkt 2 len 4 (sig created 2017-01-10)
    subpkt 16 len 8 (issuer key ID XXXXXXXXXXXXXXXX)
    data: [4095 bits]

As far as I'm informed, the bit about "digest algo 10" means that it's using SHA512 for digest. SHA1 would be "digest algo 2".

On a client, I did the following:

root@othermachine:/root# echo "deb https://debian.name-not-revealed.com xenial main" >> /etc/apt/sources.list
root@othermachine:/root# apt-key adv --keyserver pool.sks-keyservers.net --recv-keys 0xXXXXXXXX
root@othermachine:/root# apt-get update
Hit:1 http://eu-central-1.ec2.archive.ubuntu.com/ubuntu xenial InRelease
Get:2 http://eu-central-1.ec2.archive.ubuntu.com/ubuntu xenial-updates InRelease [102 kB]                                    
Get:3 http://eu-central-1.ec2.archive.ubuntu.com/ubuntu xenial-backports InRelease [102 kB]                                  
Hit:4 http://security.ubuntu.com/ubuntu xenial-security InRelease                                                            
Hit:5 http://ppa.launchpad.net/ondrej/php/ubuntu xenial InRelease                                                            
Ign:6 https://debian.name-not-revealed.com xenial InRelease                                                                
Hit:7 https://debian.name-not-revealed.com xenial Release                                                                  
Fetched 204 kB in 12s (15.9 kB/s)                                                                                                
Reading package lists... Done
W: https://debian.name-not-revealed.com/dists/xenial/Release.gpg: Signature by key 20F6C08B949AF3A95ECD7F6FDCDE5A8971317416 uses weak digest algorithm (SHA1)

Why does this warning still appear? Why does apt-get think I'm still using SHA1?

At first I assumed the key to be the culprit, so I created a new one according to this GPG migration guide: https://wiki.ubuntu.com/SecurityTeam/GPGMigration

However I'm still getting the "weak digest" warning. I'm at the end of my wits. What am I doing wrong?

0

I found the solution myself: I was using the wrong Version of GPG. gpg 1.x ignores all the "don't use SHA1" options. To use those flags, you have to use gpg 2.x which is called as "gpg2".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.