v2.46.0.vfs.0.0

[Johannes Schindelin (dscho)]

What's Changed

• Fix regression in incremental-repack maintenance step by reverting b7d6f23 (Two last-minute changes before 2.46.0 #678)
• Add advice message when expanding spare index (Two last-minute changes before 2.46.0 #678)
• Update readme about installing on older Ubuntu distributions (Update README on installing from source on older distros #677)

Full Changelog: v2.45.2.vfs.0.3...v2.46.0.vfs.0.0

---

This discussion was created from the release v2.46.0.vfs.0.0.

[Johannes Schindelin (dscho)]

A quick note: my excellent colleague Matthew John Cheetham (@mjcheetham) prepared this as a pre-release two weeks ago, and I just promoted this to a full release after receiving a couple of positive test reports.

[MacJot]

Hello,
why did you sign *.deb package using SHA1 algorithm?

Using your instruction for Linux while installing *.deb package, command debsig-verify -d msft-git.deb reports that

gpg: Note: signatures using the SHA1 algorithm are rejected
gpg: Can't check signature: Invalid digest algorithm

[Johannes Schindelin (dscho)]

I think what we want to do is to pass --gpgopts='--digest-algo SHA512' to debsigs when signing the packages.

However, I have not been able to reproduce what you described. After following these instructions, I get this:

$ debsig-verify -d msft-git.deb
debsig: Starting verification for: msft-git.deb
debsig:         getSigKeyID: got B8F12E25441124E1 for origin key
debsig: Using policy directory: /etc/debsig/policies/B8F12E25441124E1
debsig:   Parsing policy file: /etc/debsig/policies/B8F12E25441124E1/generic.pol
debsig:     parsePolicyFile: parsing '/etc/debsig/policies/B8F12E25441124E1/generic.pol'
debsig:     parsePolicyFile: completed
debsig:     Checking Selection group(s).
debsig:       Processing 'origin' key...
debsig:         getKeyID: no match, falling back to B8F12E25441124E1
debsig:         getSigKeyID: got B8F12E25441124E1 for origin key
debsig:     Selection group(s) passed, policy is usable.
debsig: Using policy file: /etc/debsig/policies/B8F12E25441124E1/generic.pol
debsig:     Checking Verification group(s).
debsig:       Processing 'origin' key...
debsig:         getKeyID: no match, falling back to B8F12E25441124E1
debsig:         getSigKeyID: got B8F12E25441124E1 for origin key
gpg: Signature made Wed 25 Sep 2024 10:02:32 AM CEST
gpg:                using RSA key 02A148FB2E0D16E17F4B1E32B8F12E25441124E1
gpg: Can't check signature: No public key
debsig: gpgVerify: gpg exited abnormally or with non-zero exit status
debsig: verifyGroupRules: failed for origin
debsig:     Verification group failed checks.
debsig: Failed verification for msft-git.deb.

Could you kindly describe in more detail how you arrived at a different outcome?

[Derrick Stolee (derrickstolee)]

I'm able to reproduce this same issue. Here's my output of debsig-verify -d msft-git.deb:

debsig: Starting verification for: msft-git.deb
debsig:         getSigKeyID: got 02A148FB2E0D16E17F4B1E32B8F12E25441124E1 for origin key
debsig: getDbPathname: using /etc/debsig/policies/B8F12E25441124E1 keyring
debsig: Using policy directory: /etc/debsig/policies/B8F12E25441124E1
debsig:   Parsing policy file: /etc/debsig/policies/B8F12E25441124E1/generic.pol
debsig:     parsePolicyFile: parsing '/etc/debsig/policies/B8F12E25441124E1/generic.pol'
debsig:     parsePolicyFile: completed
debsig:     Checking Selection group(s).
debsig:       Processing 'origin' key...
debsig: getDbPathname: using /usr/share/debsig/keyrings/B8F12E25441124E1/msft-git-public.gpg keyring
debsig:         getKeyID: mapped B8F12E25441124E1 -> 02A148FB2E0D16E17F4B1E32B8F12E25441124E1
debsig:         getSigKeyID: got 02A148FB2E0D16E17F4B1E32B8F12E25441124E1 for origin key
debsig:     Selection group(s) passed, policy is usable.
debsig: Using policy file: /etc/debsig/policies/B8F12E25441124E1/generic.pol
debsig:     Checking Verification group(s).
debsig:       Processing 'origin' key...
debsig: getDbPathname: using /usr/share/debsig/keyrings/B8F12E25441124E1/msft-git-public.gpg keyring
debsig:         getKeyID: mapped B8F12E25441124E1 -> 02A148FB2E0D16E17F4B1E32B8F12E25441124E1
debsig:         getSigKeyID: got 02A148FB2E0D16E17F4B1E32B8F12E25441124E1 for origin key
gpg: Signature made Mon 29 Jul 2024 07:56:25 PM EDT
gpg:                using RSA key 02A148FB2E0D16E17F4B1E32B8F12E25441124E1
gpg: Note: signatures using the SHA1 algorithm are rejected
gpg: Can't check signature: Invalid digest algorithm
debsig: sigVerify: gpg exited abnormally or with non-zero exit status
debsig: verifyGroupRules: failed for origin
debsig:     Verification group failed checks.
debsig: Failed verification for msft-git.deb.

Perhaps this is due to something around the gpg version?

$ gpg --version
gpg (GnuPG) 2.2.40
libgcrypt 1.10.1
Copyright (C) 2022 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/stolee/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

I've been looking for ways to reenable SHA1 via ~/.gnupg/gpg.conf but have failed so far.

[Johannes Schindelin (dscho)]

Perhaps this is due to something around the gpg version?

That's a good point:

$ gpg --version
gpg (GnuPG) 2.2.27
libgcrypt 1.9.4
Copyright (C) 2021 Free Software Foundation, Inc.
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Home: /home/virtualbox/.gnupg
Supported algorithms:
Pubkey: RSA, ELG, DSA, ECDH, ECDSA, EDDSA
Cipher: IDEA, 3DES, CAST5, BLOWFISH, AES, AES192, AES256, TWOFISH,
        CAMELLIA128, CAMELLIA192, CAMELLIA256
Hash: SHA1, RIPEMD160, SHA256, SHA384, SHA512, SHA224
Compression: Uncompressed, ZIP, ZLIB, BZIP2

I've been looking for ways to reenable SHA1 via ~/.gnupg/gpg.conf but have failed so far.

I am fairly certain that debsig-verify uses a different GPG homedir. Maybe if you find that, you can reenable SHA-1 there.