search

scm-manager / scm-manager

The easiest way to share and manage your Git, Mercurial and Subversion repositories over http.
https://scm-manager.org
GNU Affero General Public License v3.0
137 stars 29 forks source link

Red Hat repository fails verify due to SHA1 no longer being supported #2235

Open iuvooneill opened 3 days ago

iuvooneill commented 3 days ago

Issue description

The Red Hat repository as described in https://scm-manager.org/docs/3.5.x/en/installation/redhat/ does not work on later OS versions, notably RHEL 9 and derivatives.

Bug Report

Describe how to reproduce the bug

Installation being attempted on AlmaLinux 9.4, fully up to date. Simply followed the instructions to create the repo file, install the GPG key, and install scm-manager. The results give an error:

warning: Signature not supported. Hash algorithm SHA1 not available. warning: Signature not supported. Hash algorithm SHA1 not available. Problem opening package scm-server-3.5.0.noarch.rpm The downloaded packages were saved in cache until the next successful transaction. You can remove cached packages by executing 'dnf clean packages'. Error: GPG check FAILED

Describe your SCM-Manager setup

Pristine install, nothing set up yet.

Which operating system, browser and versions do you use?

AlmaLinux (RHEL-derivative) 9.4

iuvooneill commented 2 days ago

FYI, I know the workaround to allow it via update-crypto-policies, but the packages really need to be signed with SHA-256.

pfeuffer commented 2 days ago

Hey @iuvooneill , thank you very much for this and especially for the workaround. We've already taken a look at this and found an open issue regarding this (if I'm not mistaken) in the library we are using for our packaging. We will keep an eye on this.