Virtualmin PPA uses weak digest algorithm (SHA1)

[beat]

apt update gives:

W: http://software.virtualmin.com/gpl/ubuntu/dists/virtualmin-universal/Release.gpg: Signature by key 31D2B18872EAF68EFB81F81DE8DD3FA0A0BDBCF9 uses weak digest algorithm (SHA1)

2 threads 4 years ago were already notifying this:

uses weak digest algorithm (SHA1)

Dear all. Just made a fresh install on a box with Ubuntu 16.x (with php7) and installed everything using the install.sh. but when doing sudo apt-get update and sudo apt-get upgrade i get message: W: http://software.virtualmin.com/gpl/ubuntu/dists/virtualmin-xenial/Release.gpg: Signature by key 31D2B18872EAF68EFB81F81DE8DD3FA0A0BDBCF9 uses weak digest algorithm (SHA1) W: http://software.virtualmin.com/gpl/ubuntu/dists/virtualmin-universal/Release.gpg: Signature by key 31D2B18872EAF68EFB81F81…

weak digest algorithm (SHA1)

Same issue here. Virtualmin needs to update their default cert-digest-algo to be SHA256. By default gnupg defaults to using SHA1. These values go on the repository server in the gpg.conf which that Virtualmin is using. The short hand is to append: cert-digest-algo SHA256 digest-algo SHA256 To their gpg.conf file. Note to other users experiencing this issue. There is nothing you can do to correct this on your end. These changes need to be made by Virtualmin.

already reported this.

Now, Ubuntu aptitude and apt update issue warnings about those weak certificates. And apticron sends me a mail per server every day about this.

Any chances to put that pending item a bit up in the pile ? (could not reply to old auto-closed topics, so creating a new one).

[Ilia]

Hi,

Thanks for the heads up.

@Joe Is there an easy way to fix that?

[Joe]

You’re using old repos. I can’t change the signing key on the old repos. It’d be a breaking change for all old installs.

The /vm/6 repos (which have been around for several years) use a newer algorithm.

[beat]

Thank you Joe!
That was the solution! (suggestion: would be nice if the old repo could have a deprecation message with instructions to upgrade to new one).

For other readers, here is what I did to upgrade the Virtualmin GPL installs to new repo:

curl -L https://software.virtualmin.com/lib/RPM-GPG-KEY-virtualmin-6 | apt-key add -
vi /etc/apt/sources.list

and replace:

deb http://software.virtualmin.com/gpl/ubuntu/ virtualmin-xenial main
deb http://software.virtualmin.com/gpl/ubuntu/ virtualmin-universal main

by:

deb http://software.virtualmin.com/vm/6/gpl/apt virtualmin-xenial main
deb http://software.virtualmin.com/vm/6/gpl/apt virtualmin-universal main