Cannot update key: "bad signature: rejecting insecure hash SHA1"
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
I'm trying to replace my key with a new public key with an extended expiry time.
Using the web client to insert the new public key and running the generated curl command, I get the following error message:
Error in your post
-------------------
Code: 1002
Name: SIG_CANNOT_VERIFY
Description: bad signature: rejecting insecure hash SHA1
I have used gpg to set preferences of that key to prefer SHA512 over SHA1.
Any hints on how to fix the above error?
Thanks!
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the generated curl request from the web client and inspect the signature-verification path associated with SIG_CANNOT_VERIFY and the rejected SHA1 hash. Determine how the submitted public key's preferences affect verification; done means replacing the key succeeds without the insecure-hash error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100