diff options
| author | Julian Andres Klode <julian.klode@canonical.com> | 2024-12-20 11:21:29 +0100 |
|---|---|---|
| committer | Julian Andres Klode <julian.klode@canonical.com> | 2024-12-22 23:52:05 +0100 |
| commit | 153653d449efe121487641303d43ac523b9b17fb (patch) | |
| tree | e777e84b3276f79516029000f8d185adc1cb5623 /debian | |
| parent | da9a05e0b0b2150dbb67090e8b0c3922e46bd5cf (diff) | |
debian: Add default policy to allow SHA-1 self-signatures until 2026
Many repositories still have SHA-1 self-signatures, and they are not
security relevant for APT repositories in the first place since we
do not use a web of trust model, but rather a set of trusted keyrings,
and the subkey can essentially be always considered trusted even if
it cannot be verified.
Diffstat (limited to 'debian')
| -rw-r--r-- | debian/apt.install | 1 | ||||
| -rw-r--r-- | debian/default-sequoia.config | 2 |
2 files changed, 3 insertions, 0 deletions
diff --git a/debian/apt.install b/debian/apt.install index eb465d498..40bcfcf10 100644 --- a/debian/apt.install +++ b/debian/apt.install @@ -1,6 +1,7 @@ debian/*.service /usr/lib/systemd/system/ debian/*.timer /usr/lib/systemd/system/ debian/apt.systemd.daily usr/lib/apt +debian/default-sequoia.config usr/share/apt/ etc/apt/ usr/bin/apt usr/bin/apt-cache diff --git a/debian/default-sequoia.config b/debian/default-sequoia.config new file mode 100644 index 000000000..d33900281 --- /dev/null +++ b/debian/default-sequoia.config @@ -0,0 +1,2 @@ +[hash_algorithms] +sha1.second_preimage_resistance = 2026-01-01 |