#16 Please avoid using SHA1 to sign releases

[Anonymous]

When signing future releases, please avoid relying on the SHA1 digest algorithm since it is cryptographically weak and incompatible with the current OpenPGP standard.

$ sq inspect wcd-6.0.7.tar.gz.asc --keyring wcd.gpg 
wcd-6.0.7.tar.gz.asc: Detached signature.


  Error: F8F1BEA490496A09CCA328CC38C1F572B12725BE is not valid according to the current policy, ignoring
because: No binding signature at time 2026-09-12T08:39:21Z
because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
because: SHA1 is not considered secure
   Alleged signer: signer's cert not found
                   F8F1BEA490496A09CCA328CC38C1F572B12725BE
                   (signature subkey)
             Note: Signatures have NOT been verified!

See also https://www.redhat.com/en/blog/updating-gpg-keys-for-fedora-and-rhel, which is written with signing RPM packages in mind, but which nevertheless has useful general advice.