apt-get is complaining that signatures are invalid and that the
InRelease file is not signed (see Using Centos to sign .deb packages for background). On the server, I have verified using
InRelease is in fact signed.
Per Debian 9, APT, and "GPG error: ... InRelease: The following signatures were invalid:", one needs to do the following:
Adjust the personal-digest-preferences and personal-digest-preferences in $HOME/.gnupg/gpg.conf to eliminate SHA-1 from one's GPG preferences. This prevents the problem coming back with new keys.
Upon reviewing my reprepro setup, I have SHA1 shown under both the Release file (and the InRelease clearsign signature) and the individual Packages file, so I hope doing this will be successful.
~/.gnupg/gpg.conf seems to indicate that I will use hash algorithms as described by the
default-preference-list, and then lists which ones to use first if available.
[michael@bigbox ~]$ cat ~/.gnupg/gpg.conf # Prioritize stronger algorithms for new keys. default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 BZIP2 ZLIB ZIP Uncompressed # Use a stronger digest than the default SHA1 for certifications. cert-digest-algo SHA512
man gpg states:
--personal-digest-preferences string Set the list of personal digest preferences to string. Use gpg --version to get a list of available algorithms, and use none to set no preference at all. This allows the user to safely override the algorithm chosen by the recipient key preferences, as GPG will only select an algorithm that is usable by all recipients. The most highly ranked digest algorithm in this list is also used when signing without encryption (e.g. --clear-sign or --sign).
And I see
gpg --version in fact shows SHA1 as being included.
michael@bigbox ~]$ gpg --version gpg (GnuPG) 2.0.22 libgcrypt 1.5.3 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Home: ~/.gnupg Supported algorithms: Pubkey: RSA, ?, ?, ELG, DSA Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH, CAMELLIA128, CAMELLIA192, CAMELLIA256 Hash: MD5, SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224 Compression: Uncompressed, ZIP, ZLIB, BZIP2
I only have one key.
[michael@bigbox ~]$ gpg --list-keys /home/michael/.gnupg/pubring.gpg -------------------------------- pub 2048R/542342AE 2018-02-08 uid Michael Jones <[email protected]> sub 2048R/4D73CC3A 2018-02-08
And give it a try...
[michael@bigbox ~]$ gpg --edit-key 542342AE gpg (GnuPG) 2.0.22; Copyright (C) 2013 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Secret key is available. pub 2048R/542342AE created: 2018-02-08 expires: never usage: SC trust: ultimate validity: ultimate sub 2048R/4D73CC3A created: 2018-02-08 expires: never usage: E [ultimate] (1). Michael Jones <[email protected]> gpg> setpref SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed Set preference list to: Cipher: AES256, AES192, AES, CAST5, 3DES Digest: SHA512, SHA384, SHA256, SHA224, SHA1 Compression: ZLIB, BZIP2, ZIP, Uncompressed Features: MDC, Keyserver no-modify Really update the preferences? (y/N)
SHA1 still there?
Note that the above referenced post Debian 9, APT, and "GPG error: ... InRelease: The following signatures were invalid:" states that one must adjust the
$HOME/.gnupg/gpg.conf twice, so I am concerned that potentially there is something else which needs to be changes.
I don't think it matters, but I am running Centos7.
How do I prevent gpg from including SHA1?