Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #165531 > unrolled thread

weak repository key

Back to article view | Back to linux.debian.user

Contents

  weak repository key Floris <jkfloris@dds.nl> - 2016-03-17 17:00 +0100
    Re: weak repository key Jochen Spieker <ml@well-adjusted.de> - 2016-03-17 17:00 +0100
      Re: weak repository key Sven Hartge <sven@svenhartge.de> - 2016-03-17 18:20 +0100
        Re: Re: weak repository key Daniel Schröter <d.schroeter@gmx.de> - 2016-03-28 21:20 +0200
          Re: weak repository key Sven Hartge <sven@svenhartge.de> - 2016-03-28 21:50 +0200
          Re: weak repository key The Wanderer <wanderer@fastmail.fm> - 2016-03-29 16:00 +0200

#165531 — weak repository key

After updating to apt version 1.2.7 I get a warning on apt-get update:
W:  
gpgv:/var/lib/apt/lists/partial/dl.google.com_linux_chrome_deb_dists_stable_Release.gpg:  
The repository is insufficiently signed by key  
4CCA1EAF950CEE4AB83976DCA040830F7FAC5991 (weak digest)

and the repository is ignored

Is there a way that apt re-trust the old SHA1 key, or do we have to report  
this to Google and all other repos?

Floris

[toc] | [next] | [standalone]

#165532

[Multipart message — attachments visible in raw view] — view raw

Floris:
> After updating to apt version 1.2.7 I get a warning on apt-get update:
> W: gpgv:/var/lib/apt/lists/partial/dl.google.com_linux_chrome_deb_dists_stable_Release.gpg:
> The repository is insufficiently signed by key
> 4CCA1EAF950CEE4AB83976DCA040830F7FAC5991 (weak digest)
> 
> and the repository is ignored
> 
> Is there a way that apt re-trust the old SHA1 key, or do we have to report
> this to Google and all other repos?

Report it:
https://lists.debian.org/debian-devel-announce/2016/03/msg00006.html

J.
-- 
My drug of choice is self-pity.
[Agree]   [Disagree]
                 <http://archive.slowlydownward.com/NODATA/data_enter2.html>

[toc] | [prev] | [next] | [standalone]

#165551

Jochen Spieker <ml@well-adjusted.de> wrote:
> Floris:

>> After updating to apt version 1.2.7 I get a warning on apt-get update:
>> W: gpgv:/var/lib/apt/lists/partial/dl.google.com_linux_chrome_deb_dists_stable_Release.gpg:
>> The repository is insufficiently signed by key
>> 4CCA1EAF950CEE4AB83976DCA040830F7FAC5991 (weak digest)
>> 
>> and the repository is ignored
>> 
>> Is there a way that apt re-trust the old SHA1 key, or do we have to report
>> this to Google and all other repos?

> Report it:
> https://lists.debian.org/debian-devel-announce/2016/03/msg00006.html

According to
https://bugs.chromium.org/p/chromium/issues/detail?id=594414 this should
be fixed with the next repository update.

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

[toc] | [prev] | [next] | [standalone]

#166040

I still have the problem. Someone else too?

[toc] | [prev] | [next] | [standalone]

#166042

Daniel Schröter <d.schroeter@gmx.de> wrote:

> I still have the problem. Someone else too?

Well, Google has not fixed this, so of course you still have the
problem. But there is _nothing_ Debian can do here.

The bug is at
<https://bugs.chromium.org/p/chromium/issues/detail?id=596074> and has
not seen much action.

But since Ubuntu Xenial 16.04 will release with an apt version also
showing this warning, I guess this will get a lot more traction as soon
as Xenial is released because a lot more "normal" people will then get
the warning and not just people running Debian Testing/Unstable or
Beta-Versions of Ubuntu.

Grüße,
Sven.

-- 
Sigmentation fault. Core dumped.

[toc] | [prev] | [next] | [standalone]

#166063

[Multipart message — attachments visible in raw view] — view raw

On 2016-03-28 at 15:15, Daniel Schröter wrote:

> I still have the problem. Someone else too?

The list of repositories which are known to have this problem is
available here:

https://wiki.debian.org/Teams/Apt/Sha1Removal

The only way for the problem to be fixed, short of reverting the
software feature change which introduced it (which would reintroduce
security weaknesses), is for the people who run those repositories to
re-sign their files as described on that page.

-- 
   The Wanderer

The reasonable man adapts himself to the world; the unreasonable one
persists in trying to adapt the world to himself. Therefore all
progress depends on the unreasonable man.         -- George Bernard Shaw

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web