On Tue, Mar 08, 2022 at 07:40:15PM +0100, Alexander Sosedkin wrote: > the only realistic way to weed out its reliance on SHA-1 signatures > from all of its numerous dark corners is to break them. > Make creation and verification fail in default configuration. That sounds like a terrible plan. We should make newer hashes the default, and we can make tools print a warning if sha1 is used where it shouldn't, but please don't break things on purpose. For many many things sha1 is just fine. Just like md5 or even crc32. Not everything is about cryptographic security. Also, users will want to verify old signatures essentially forever. This should be always possible. And finally, the world is huge, and other users will provide sha1 signatures no matter what we do, and it is better to check those than to completely ignore them. Zbyszek (This is a bit like browsers disliking self-signed certs and http:// — it certainly is OK to make users aware of the issue, but actually disallowing those is terribly annoying and will only result in users jumping to different tools.) _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
