From: Greg T. <gd...@le...> - 2022-03-09 17:34:28
|
Richard Shaw <hob...@gm...> writes: > On Wed, Mar 9, 2022 at 8:01 AM Greg Troxel <gd...@le...> wrote: > >> >> Richard Shaw <hob...@gm...> writes: >> >> > Just a heads up, but Fedora Linux is considering dropping SHA-1 support >> > since it's no longer considered secure. I can't remember what TQSL uses >> so >> > wanted to check her if TQSL would be impacted. >> >> Do you mean "remove support for SHA-1 from the system"? That seems >> extreme and likely to cause a huge amount of trouble. What's the story >> about git? >> >> If you mean "encorage use of SHA2 and others instead for most uses, and >> require it for validating packages", that's something else. > > Here's the link to the thread. It's probably better to read it there than > for me to try and paraphrase. I'm certainly not an encryption expert by any > means. > > https://lists.fedoraproject.org/archives/list/de...@li.../thread/VVLHQAWI3IQ7NRLKMUHJ27JV3V2JAFDP/ Thanks. It looks like it means withdraw SHA-1 from openssl. Wow. Here's the key quote: Fedora is a large distribution with short release cycles, and the only realistic way to weed out its reliance on SHA-1 signatures from all of its numerous dark corners is to break them. |