reprepro still generates SHA1 sum

[Patrick Banholzer]

A while ago I filed a question, but there was no reasonable response, so I file this bug!
https://answers.launchpad.net/ubuntu/+source/reprepro/+question/292432

I have a package mirror built with reprepro in which I deliver self-built packages to our customers systems. After testing with Ubunut Xenial apt-get update is complaining about SHA1 Hash in "InRelease" file on the mirror.

I did some troubleshooting, including generating a new gpg key with "--digest-algo SHA512" and doing a reprepro export xenial

InRelease file was upgraded but it's still a SHA1 hash.

First tested this with the standard version of trusty (4.13.1-1build1). After having no luck with my troubleshooting gpg I upgraded to the Xenial version of reprepro (4.17.0-1) but this doesn't help either.

To be more precise: This is not about the SHA-Sum of the files listed in the "InRelease" file. This is about the PGP signature of the whole InRelease file (2nd line of the file looks like this: "Hash: SHA1")

Due to Xenial complaining about this, reprepro should be patched to take care of this hash!

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Dan Kegel (obdank)]

Your question
https://answers.launchpad.net/ubuntu/+source/reprepro/+question/292432
did get an answer eventually:

"I fixed this problem by adding the following to ~/.gnupg/gpg.conf (courtesy of https://www.osso.nl/blog/apt-insufficiently-signed-weak-digest/):

personal-digest-preferences SHA512 SHA384 SHA256 SHA224
"

There's a slightly different answer in
http://askubuntu.com/questions/819641/reprepro-signature-by-key-uses-weak-digest-algorithm-sha1

Perhaps this is a doc bug, and the manpage needs updating?

[Patrick Banholzer (patrick-banholzer)]

Indeed I added something to the ~/.gnupg/gpg.conf:
default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 BZIP2 ZLIB ZIP Uncompressed
digest-algo sha256
cert-digest-algo SHA256

It was some time ago so I don't remember which of the three lines where the right config item(s).

The bug can be archived. Forgot to update this bug after I solved it.

[webworm (rudy-webworm)]

Actually the only relevant line is:

digest-algo sha256