Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1280414

Bug#1126793: dgit: autopkgtest regression: SHA1 is not considered secure since 2026-02-01T00:00:00Z

Show all headers | View raw

On Sun, Feb 01, 2026 at 02:55:31PM +0000, Simon McVittie wrote:
> Perhaps the test keys in src/tests/tstunt/gpg, which seem to have been 
> generated in 2013/2014, need to be regenerated with a SHA256 
> self-signature or replaced with new keys so that apt will still consider 
> them to be sufficiently strong? Or perhaps the signing key is somewhere 
> else, I'm not familiar with this test suite.

If the keys are not actually relevant to the test (they probably 
can't be secure) maybe it'd be better if the test generates new 
keys, or just used `Trusted: yes` in the APT sources.

Testing APT's signature verification doesn't seem particularly 
useful in src:dgit?

Chris

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1126793: dgit: autopkgtest regression: SHA1 is not considered secure since 2026-02-01T00:00:00Z Simon McVittie <smcv@debian.org> - 2026-02-01 16:10 +0100
  Bug#1126793: dgit: autopkgtest regression: SHA1 is not considered secure since 2026-02-01T00:00:00Z Chris Hofstaedtler <zeha@debian.org> - 2026-02-01 16:20 +0100
  Bug#1126793: dgit: autopkgtest regression: SHA1 is not considered secure since 2026-02-01T00:00:00Z [and 1 more messages] Ian Jackson <ijackson@chiark.greenend.org.uk> - 2026-02-01 17:50 +0100
    Bug#1126793: dgit: autopkgtest regression: SHA1 is not considered secure since 2026-02-01T00:00:00Z [and 1 more messages] Ian Jackson <ijackson@chiark.greenend.org.uk> - 2026-02-01 17:50 +0100
      Bug#1126793: dgit: autopkgtest regression: SHA1 is not considered secure since 2026-02-01T00:00:00Z [and 1 more messages] Ian Jackson <ijackson@chiark.greenend.org.uk> - 2026-02-02 20:30 +0100

csiph-web