New requirements for APT repository signing

Julian Andres Klode <[email protected]> Wed, 28 Feb 2024 20:20:12 +0100

Newsgroups	gmane.linux.debian.devel.announce
Message-ID	<[email protected]>

APT 2.7.13 just landed in unstable and with GnuPG 2.4.5 installed,
or 2.4.4 with a backport from the 2.4 branch, requires repositories
to be signed using one of

- RSA keys of at least 2048 bit
- Ed25519
- Ed448

Any other keys will cause warnings. These warnings will become
errors in March as we harden it up for the Ubuntu 24.04 release,
which was the main driver to do the change *now*.

If you operate third-party repositories using different key
algorithms, now is your time to migrate before you get hit
with an error.

For the Ubuntu perspective, feel free to check out the discourse
post:

https://discourse.ubuntu.com/t/new-requirements-for-apt-repository-signing-in-24-04/42854
-- 
debian developer - deb.li/jak | jak-linux.org - free software dev
ubuntu core developer                              i speak de, en

signature.asc (application/pgp-signature, 833 B)