apt/debian/default-sequoia.config, branch main Debians commandline package manager https://git.kalnischkies.de/apt/atom?h=main 2025-04-25T21:07:07Z Update Sequoia crypto policy 2025-04-25T21:07:07Z Julian Andres Klode julian.klode@canonical.com 2025-04-25T18:03:52Z urn:sha1:0989275c2f7afb7a5f7698a096664a1035118ebf Move our cut-offs to February to align with Sequoia, and cut-off more: - 2024-02: DSA keys retroactively (align with GnuPG config) - 2026-02: SHA224 hashes - 2028-02: Brainpool keys (align closer with GnuPG backend) - 2030-02: RSA2048 keys These algorithms will not be valid starting on those cut-off dates. Gbp-Dch: full Extend v3 subkey expiry to 2026, owing to OBS use 2025-01-01T12:28:57Z Julian Andres Klode julian.klode@canonical.com 2025-01-01T12:17:00Z urn:sha1:3c4d0d25e1c35af16b66a4dee48fb3b0ed9d50a5 SUSE's Open Build Service is signing multiple repositories using v3 signing keys. debian: Add default policy to allow SHA-1 self-signatures until 2026 2024-12-22T22:52:05Z Julian Andres Klode julian.klode@canonical.com 2024-12-20T10:21:29Z urn:sha1:153653d449efe121487641303d43ac523b9b17fb Many repositories still have SHA-1 self-signatures, and they are not security relevant for APT repositories in the first place since we do not use a web of trust model, but rather a set of trusted keyrings, and the subkey can essentially be always considered trusted even if it cannot be verified.