DRAFT: RSA SHA1 signature support is insecure
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Active
- Tech stack
- go
- Domain
- cryptography, security
Research direction
No files or tests are named. Start by tracing how apko verifies APKINDEX and .apk signatures, then review the existing RSA and RSA256 handling alongside the repository compatibility constraints. Done should be defined around communicating RSA-SHA1 weakness while preserving a managed path for repositories that still require it.
Written by the indexing model from the issue text.
Description
Currently apk-tools, apko, and melange support verifying APKINDEX and .apk signatures of types:
- RSA - RSA signature using SHA1 message digest
- RSA256 - RSA signature using SHA256 message digest
apko & melange are planning to add support for verifying APKINDEX and .apk signatures using:
- ML-DSA-86 type signature
Universally RSA-SHA1 signatures are no longer considered secure and are being universally withdrawn and removed.
Wolfi & Chainguard apk repositories transitioned to RSA256 signatures on 2025-01-30.
apko & melange would like to add warnings, add security levels, and remove weak verification, but:
- alpinelinux.org repositories are still signed with RSA-SHA1
- JFrog Artifactory repositories are still signed with RSA-SHA1
Users may want to know this, and yet need to continue to use those, and have a managed upgrade path.
- Dominant language
- Go
- Stars
- 1.7k
- Forks
- 228
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 62
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from chainguard-dev/apko
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
chainguard-dev/apko#2496 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
chainguard-dev/apko#2495 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
chainguard-dev/apko#2494 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
chainguard-dev/apko#2484 ·
-
Difficulty 2/5 Half a day Newbie friendliness 76/100
chainguard-dev/apko#2483 ·
All issues in chainguard-dev/apko
Similar issues
-
optimization optimization:agents-md-curator
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
githubnext/gh-aw-cao#13143 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
blinklabs-io/bursa#904 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
yanet-platform/ipfw-go#129 ·
-
bug confmap/provider/googlesecretmanagerprovider needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
open-telemetry/opentelemetry-collector-contrib#51273 · 2 comments ·
-
bug: AI Gateway client filter lists "Unknown" twice when NULL and literal Unknown clients coexist Openbug
Difficulty 2/5 1-3 hours Newbie friendliness 90/100