Devuan bug report logs - #891
devuan-keyring: New signing key needed?

Package: devuan-keyring; Maintainer for devuan-keyring is Devuan Developers <devuan-dev@lists.dyne.org>; Source for devuan-keyring is src:devuan-keyring.

Reported by: Martin <Martin@lichtvoll.de>

Date: Mon, 26 May 2025 15:18:01 UTC

Severity: normal

Found in version devuan-keyring/2023.10.07

Full log

🔗 View this message in rfc822 format

Subject: bug#891: devuan-keyring: New signing key needed?
Reply-To: Mark Hindley <mark@hindley.org.uk>, 891@bugs.devuan.org
Resent-From: Mark Hindley <mark@hindley.org.uk>
Resent-To: devuan-bugs@lists.dyne.org
Resent-CC: Devuan Developers <devuan-dev@lists.dyne.org>
Resent-Date: Mon, 02 Jun 2025 16:06:01 +0000
Resent-Message-ID: <handler.891.B891.174888027224742@bugs.devuan.org>
Resent-Sender: owner@bugs.devuan.org
References: <12678847.O9o76ZdvQC@lichtvoll.de> <12678847.O9o76ZdvQC@lichtvoll.de>
Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=193.36.131.86; helo=mx.hindley.org.uk; envelope-from=mark@hindley.org.uk; receiver=<UNKNOWN> 
Date: Mon, 2 Jun 2025 17:03:56 +0100
From: Mark Hindley <mark@hindley.org.uk>
To: Martin <Martin@lichtvoll.de>, 891@bugs.devuan.org
Message-ID: <aD3LbBatRfW-nivX@hindley.org.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <12678847.O9o76ZdvQC@lichtvoll.de>

Martin,

Thanks for this.

On Mon, May 26, 2025 at 05:15:50PM +0200, Martin wrote:
> Package: devuan-keyring
> Version: 2023.10.07
> Severity: normal
> X-Debbugs-Cc: Martin@Lichtvoll.de
> 
> Dear Mark, dear Devuan development team.
> 
> In Devuan Ceres I keep getting a warning about policy rejecting signature
> within a year which I got explained by Apt by using "--audit":
> 
> % LANG=C apt update --audit
> Hit:1 http://deb.devuan.org/merged ceres InRelease
> All packages are up to date.    
> Warning: http://deb.devuan.org/merged/dists/ceres/InRelease: Policy will 
> reject signature within a year, see --audit for details
> Audit: http://deb.devuan.org/merged/dists/ceres/InRelease: Sub-process /
> usr/bin/sqv returned an error code (1), error message is:
>    Signing key on 72E3CB773315DFA2E464743D94532124541922FB is not bound:
>               No binding signature at time 2025-05-25T14:45:30Z
>      because: Policy rejected non-revocation signature 
> (PositiveCertification) requiring second pre-image resistance
>      because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

This looks as if sqv (the new rust-based key verifier) is going to be more picky
about SHA1.

At the moment, I think ceres and all of the unmerged repos
(pkgmaster.devuan.org/devuan) use a SHA1 key.

Generating and using a new key is not too problematic, but getting it
distributed is more so. You end up in a chicken and egg cycle with the new key
being used but apt refusing to update the devuan-keyring package because it
can't verify the key.

Does anybody have a good idea how to resolve that? We will have lots of unhappy
users if they can no longer apt update|upgrade|install.

Mark

Send a report that this bug log contains spam.

Devuan bug report logs - #891 devuan-keyring: New signing key needed?

Devuan bug report logs - #891
devuan-keyring: New signing key needed?