keybase / keybase/keybase-issues
Code signing key uses an insecure hash algorithm
Open
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
```sh
$ sudo rpm --import https://keybase.io/docs/server_security/code_signing_key.asc
warning: Signature not supported. Hash algorithm SHA1 not available.
error: https://keybase.io/docs/server_security/code_signing_key.asc: key 1 import failed.
```
At the least, this prevents use on RHEL 9.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the `rpm --import` command against the code-signing key URL and confirm the SHA1 failure on RHEL 9. Review how the published key is maintained, then verify that the replacement signing key imports successfully without the unsupported-hash error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100