diff options
| author | Julian Andres Klode <julian.klode@canonical.com> | 2025-04-25 20:03:52 +0200 |
|---|---|---|
| committer | Julian Andres Klode <jak@debian.org> | 2025-04-25 21:07:07 +0000 |
| commit | 0989275c2f7afb7a5f7698a096664a1035118ebf (patch) | |
| tree | 35a9d6f7c6fa062f26e2931726d12e779210dfbd | |
| parent | ccd3b00975f96a62835e02cd243f624d47812b56 (diff) | |
Update Sequoia crypto policy
Move our cut-offs to February to align with Sequoia, and cut-off more:
- 2024-02: DSA keys retroactively (align with GnuPG config)
- 2026-02: SHA224 hashes
- 2028-02: Brainpool keys (align closer with GnuPG backend)
- 2030-02: RSA2048 keys
These algorithms will not be valid starting on those cut-off dates.
Gbp-Dch: full
| -rw-r--r-- | debian/default-sequoia.config | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/debian/default-sequoia.config b/debian/default-sequoia.config index b0abc90ee..0bb0b9c41 100644 --- a/debian/default-sequoia.config +++ b/debian/default-sequoia.config @@ -1,4 +1,18 @@ +# Default APT Sequoia configuration. To overwrite, consider copying this +# to /etc/crypto-policies/back-ends/apt-sequoia.config and modify the +# desired values. +[asymmetric_algorithms] +dsa2048 = 2024-02-01 +dsa3072 = 2024-02-01 +dsa4096 = 2024-02-01 +brainpoolp256 = 2028-02-01 +brainpoolp384 = 2028-02-01 +brainpoolp512 = 2028-02-01 +rsa2048 = 2030-02-01 + [hash_algorithms] -sha1.second_preimage_resistance = 2026-01-01 +sha1.second_preimage_resistance = 2026-02-01 # Extend the expiry for legacy repositories +sha224 = 2026-02-01 + [packets] -signature.v3 = 2026-01-01 +signature.v3 = 2026-02-01 # Extend the expiry |