Dear Debian developers, Is there any way to replace a SHA1 self-binding signature in a GPG public key ?
I get the message
dpkg-source: info: verifying ../pari_2.19.0.orig.tar.gz.asc
Signing key on 42028EA404A2E9D80AC453148F0E7C2B4522E387 is not bound:
No binding signature at time 2026-09-28T08:47:24Z
because: Policy rejected non-revocation signature (PositiveCertification)
requiring second pre-image resistance
because: SHA1 is not considered secure since 2023-02-01T00:00:00Z
dpkg-source: warning: cannot verify upstream tarball signature for
../pari_2.19.0.orig.tar.gz: no acceptable signature found
(this key is in the Debian keyring)
Should I rather generate a new key ?
Cheers,
--
Bill. <[email protected]>
Imagine a large red swirl here.
signature.asc
Description: PGP signature
