tls in ubuntu-push client doesn't support certs with 384/512 signatures...

[Samuele Pedroni]

we noticed this when webops tried to replace the push.ubuntu.com certificates, for now they reverted the cert and are looking into getting us new shorter bits cert for a while;

see

http://bridge.grumpy-troll.org/2014/05/golang-tls-comodo/

we need to sprinkle import _ "crypto/sha512" around

[Pat McGowan (pat-mcgowan)]

For now the server cert was reverted, need a permanent solution

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Joey Stanford (joey)]

fwiw, we've had to stop issuing SHA-512 certs for fear that it will affect users. We do have some 512s that are out there yet. I'd like to resume issuing 512s instead of 256 as soon as you believe the fix has been populated out to the user base. At that time we'll start to re-issue our 256s as 512s when they expire.

Our normal process is to choose a security stance that allows for the widest amount of access using protocols that are still considered secure. In this specific case, the algorithms to support 512 are (usually) part of the 256 set but yet provide a slightly better security posture and have slightly better hashing performance over 256. SHA-2 has been out since 2001 and I believe it's penetration is sufficient at this point for us to legitimately use it without any ill effects.

[Samuele Pedroni (pedronis)]

this doesn't affect vivid because account-polld and ubuntu-push-client are compiled with go 1.3.3 there so this go upstream change applies:

https://github.com/golang/go/commit/b53bb2cae512ce4abb

[Pat McGowan (pat-mcgowan)]

marking invalid since vivid sync will fix it and no need to backport anything