[Debian-ports-devel] Debian Ports no longer accepts SHA-1 signatures

[Aurelien Jarno]

Dear all,

Following the changes on the main archive [1], mini-dak on the Debian
Ports archive now requires that uploads are signed by a strong SHA
224 to 512 algorithm. The same way the .dsc and .changes files are
now verified using the SHA-256 checksums.

Please ensure that GPG is configured correctly. That should be the case
for build daemons running sid, for the one using stable, please make
sure that you add

    personal-digest-preferences SHA256

(or another strong algorithm) to ~/.gnupg/gpg.conf.

To my knowledge, the only recent builds rejected due to this changes are
the x32 ones built on frobozz. Daniel, could you please update the GPG
configuration?

Thanks,
Aurelien


[1] https://lists.debian.org/debian-devel-announce/2017/02/msg00007.html
-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien at aurel32.net                 http://www.aurel32.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/debian-ports-devel/attachments/20170412/c5a2a755/attachment.sig>