Hi all,
After the SHA1 hashes have been banned from our Manifest files [1],
the question arose in #gentoo-portage if the default algorithm used
for manifest signing should also be changed to something different
from SHA1 (which is still the GnuPG default). According to the table
in section 14 of RFC 4880 [2], SHA256 looks like a reasonable choice
for key sizes of 2048 to 4096 bits.
However, I remember that there used to be some problems with SHA256
and DSA keys. Before we add "--digest-algo SHA256" to the default
PORTAGE_GPG_SIGNING_COMMAND in make.globals, I'd like to ask for
feedback if it works without problems. So, could some volunteers
please add the following line to their make.conf:
PORTAGE_GPG_SIGNING_COMMAND="gpg --sign --clearsign --yes --digest-algo
SHA256 --default-key \"\${PORTAGE_GPG_KEY}\" --homedir \"\${PORTAGE_GPG_DIR}\"
\"\${FILE}\""
and report back if this causes any trouble with manifest signing?
Thanks,
Ulrich
[1] <http://permalink.gmane.org/gmane.linux.gentoo.devel.announce/1679>
[2] <http://www.ietf.org/rfc/rfc4880.txt>
