On úterý 13. června 2023 16:57:42 CEST Neal H. Walfield wrote:
On Thu, 08 Jun 2023 21:37:09 +0200,
Ondřej Budai wrote:
> RPM Sequoia's crypto policies can be configured, so you should be able to
re-enable SHA-1. However, this would
> be a global change, not only for EL6... See
>
https://docs.rs/sequoia-policy-config/latest/sequoia_policy_config/#hash-...
> ...
> On Thu, Jun 8, 2023 at 5:42 PM Pavel Raiskup <praiskup(a)redhat.com> wrote:
>
> Hello maintainers!
>
> Copr builders have been updated to Fedora 38 today (some old builders
> might still be running F37 ATM, but when they finish the task(s) they
> work on, they will be deleted). Our testsuite is passing just fine, so
> you _should_ be fine too :-). Please let us know if you have some
> troubles.
>
> There was one important change in Fedora 38 - RPM switched to the
> Sequoia crypto backend. It refuses SHA-1 in crypto; which basically
> disallows Mock to properly check EL6 GPG signatures. To allow further
> builds, we switched to gpgcheck=0 for all epel-6 chroots. If you know a
> better work-around, let me know.
I find this behavior surprising. The default policy as set by
fedora-crypto-policies is for rpm-sequoia is to accept SHA-1 (and
DSA-1024, ...):
https://gitlab.com/redhat-crypto/fedora-crypto-policies/-/blob/master/pol...
What policy are you using?
I was wrong. The problem was *not* with the EPEL-6 signatures, but with
CentOS 6 signatures. It is a bit harder to analyse, as
`sq-keyring-linter` is silent for that one:
$ sq-keyring-linter < /usr/share/distribution-gpg-keys/centos/RPM-GPG-KEY-CentOS-6
$ echo $?
0
Pavel