Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

SHA1 Key signature warnings in Debian build for releases 3.x #979

Open
linqigang888 opened this issue Jul 12, 2023 · 16 comments
Open

SHA1 Key signature warnings in Debian build for releases 3.x #979

linqigang888 opened this issue Jul 12, 2023 · 16 comments
Assignees
@ecrist
Labels
packaging Priority Acknowledged priority

Comments

@linqigang888
Copy link

I am the Debian maintainer for easy-rsa. While building the latest release, I received the following output:

dpkg-source: info: using source format '3.0 (quilt)'
dpkg-source: info: verifying ./easy-rsa_3.1.5.orig.tar.gz.asc
gpgv: Signature made Sat 10 Jun 2023 08:58:15 PM +07
gpgv:                using RSA key C8FCA3E7F787072CDEB91D2F72964219390D0D0E
gpgv: Note: signatures using the SHA1 algorithm are rejected
gpgv: WARNING: signing subkey 72964219390D0D0E has an invalid cross-certification
gpgv: Can't check signature: General error
dpkg-source: warning: cannot verify upstream tarball signature for ./easy-rsa_3.1.5.orig.tar.gz: no acceptable signature found

I took the latest public key from here and the .tgz and .tgz.sig from here.
Could you look into the issues with cross-certification and SHA1?
@ecrist
Copy link
Member

ecrist commented Jul 12, 2023 via email

@TinCanTech
Copy link
Collaborator

TinCanTech commented Jun 30, 2024 •
edited
Loading

Release 3.1.5, replaced by 3.1.6 and 3.1.7, without complaint.

@linqigang888
Copy link
Author

Please reopen, since this is still an issue:

dpkg-source: info: using source format '3.0 (quilt)'
dpkg-source: info: verifying ./easy-rsa_3.2.0.orig.tar.gz.asc
gpgv: Signature made Sat 18 May 2024 07:21:02 PM +07
gpgv:                using RSA key C8FCA3E7F787072CDEB91D2F72964219390D0D0E
gpgv: Note: signatures using the SHA1 algorithm are rejected
gpgv: WARNING: signing subkey 72964219390D0D0E has an invalid cross-certification
gpgv: Can't check signature: General error
dpkg-source: warning: cannot verify upstream tarball signature for ./easy-rsa_3.2.0.orig.tar.gz: no acceptable signature found
dpkg-source: info: building easy-rsa using existing ./easy-rsa_3.2.0.orig.tar.gz
dpkg-source: info: building easy-rsa using existing ./easy-rsa_3.2.0.orig.tar.gz.asc
dpkg-source: info: building easy-rsa in easy-rsa_3.2.0-1.debian.tar.xz
dpkg-source: info: building easy-rsa in easy-rsa_3.2.0-1.dsc

@TinCanTech TinCanTech reopened this Jul 1, 2024
@TinCanTech TinCanTech changed the title Key signature warnings in Debian build for release 3.1.5 SHA1 Key signature warnings in Debian build for releases 3.x Jul 1, 2024
@TinCanTech TinCanTech added the Priority Acknowledged priority label Jul 1, 2024
@TinCanTech TinCanTech added this to the v3.2.1 milestone Jul 1, 2024
@TinCanTech
Copy link
Collaborator

@ecrist are you willing to upgrade your key yet ?

@TinCanTech
Copy link
Collaborator

TinCanTech commented Jul 11, 2024 •
edited
Loading

@ecrist

FTR:

While there was some reconfiguration under the hood, the main difference between Easy-RSA v3.0.8 and v3.1.x is support for OpenSSL v3.x.x, over OpenSSL v.1.x.x.

Easy-RSA v3.1.7 is signed by your current SHA1 key.

  • This is a good base-line.

Easy-RSA v3.2.0 is signed by your current SHA1 key.

  • This is a good hand-over opportunity.

Easy-RSA v3.2.1 could be signed by your new SHA256 key.

@sdavids
Copy link

sdavids commented Aug 3, 2024

Could we maybe get a new version in the Debian repos?

$ cat /etc/os-release 
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
$ apt-cache showpkg easy-rsa
Package: easy-rsa
Versions: 
3.1.0-1 (/var/lib/apt/lists/deb.debian.org_debian_dists_bookworm_main_binary-amd64_Packages) (/var/lib/dpkg/status)
 Description Language: 
                 File: /var/lib/apt/lists/deb.debian.org_debian_dists_bookworm_main_binary-amd64_Packages
                  MD5: 30ef8db774064b75fc32b3b7baedeb03
 Description Language: en
                 File: /var/lib/apt/lists/deb.debian.org_debian_dists_bookworm_main_i18n_Translation-en
                  MD5: 30ef8db774064b75fc32b3b7baedeb03


Reverse Depends: 
  fbx-all,easy-rsa
  openvpn,easy-rsa
Dependencies: 
3.1.0-1 - openssl (0 (null)) opensc (0 (null)) 
Provides: 
3.1.0-1 - 
Reverse Provides: 
$ /usr/share/easy-rsa/easyrsa --version
EasyRSA Version Information
Version:     3.1.0
Generated:   Wed May 18 20:53:50 CDT 2022
SSL Lib:     OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024)
Git Commit:  1600b3fe9bd71e229b8648cd24206c55917b2f9b
Source Repo: https://github.com/OpenVPN/easy-rsa

@linqigang888
Copy link
Author

easy-rsa 3.2.0-1 is available in Debian's unstable and testing distributions. Here is documentation on choosing a Debian distribution to have packages from.

@sdavids
Copy link

sdavids commented Aug 5, 2024

Can I use Sid packages on "stable"?

I should have phrased my comment differently 😉

Is it possible to promote a version greater than 3.1.0 from unstable to stable?

@linqigang888
Copy link
Author

It is possible to backport new features to stable, but I want to avoid doing that since openssl is a dependency of easy-rsa. Backporting easy-rsa without a backported openssl would most likely lead to instabilities.

@TinCanTech
Copy link
Collaborator

EasyRSA is tested against OpenSSL 1.1.1f 31 Mar 2020 and various OpenSSL version 3 binaries.

@linqigang888
Copy link
Author

I would rather volunteer my time doing other things than backporting in Debian, but any Debian Developer should be able to backport in my place.

While it is not recommended in Debian to install packages from testing or unstable, it is an option for users.

@sdavids
Copy link

sdavids commented Aug 5, 2024

Even stable is updated once in a while. Those updates are called "Point Releases". They usually incorporate the security fixes released until the time of the update and fixes for important bugs in the current release.

https://wiki.debian.org/DebianReleases/PointReleases

Uploading to stable means that the package will be transferred to the proposed-updates-new queue for review by the stable release managers, and if approved will be installed in the stable-proposed-updates directory of the Debian archive. From there, it will be included in stable with the next point release.
[...]
The bug should be of severity "important" or higher.
[...]
Fixes must be minimal and relevant and include a sufficiently detailed changelog entry

https://www.debian.org/doc/manuals/developers-reference/pkgs.html#upload-stable

Currently, the easy-rsa project does not closely adhere to Semantic versioning—patch releases add/change/remove functionality, for example:

3.1.2

Command 'renew': Remove option 'nopass'
Introduce command 'set-pass'

As it is now, the easy-rsa version is frozen in stable: Every two years we get a new version via a Debian release and the version in a specific release is frozen for its 3 (5 LTS) year lifecycle.

@sdavids
Copy link

sdavids commented Aug 5, 2024

NOTICE: EasyRSA version 3.2.0 is a development snapshot.

https://github.com/OpenVPN/easy-rsa/releases/tag/v3.2.0

[2024-05-31] easy-rsa 3.2.0-1 MIGRATED to testing (Debian testing watch)

https://tracker.debian.org/pkg/easy-rsa/news/?page=1

Is it correct, that 3.2.0 is already in Debian testing? — Should it not remain in unstable?

If Debian were to cut its trixie release today, it would bake in this version for the upcoming 3-5 years.

@TinCanTech
Copy link
Collaborator

TinCanTech commented Aug 5, 2024 •
edited
Loading

I strongly advise that debian does not pick up EasyRSA v3.2.0

It would be much better long-term to pick v3.2.1, upon its release - September 2024.

If that is not possible then debian should use EasyRSA v3.1.7

@linqigang888
Copy link
Author

It usually takes 2-5 days for packages to migrate from unstable to testing. Debian's tracker pages for packages helps to see the status of a package in Debian.

No bugs have been reported so far for the easy-rsa 3.2.0-1 in Debian testing or unstable, so there should be no issue having this version. With a planned release for September 2024, I can easily package easy-rsa 3.2.1-1 before the next stable Debian release.

Importing upstream versions earlier to unstable and testing helps test for longer so that bugs can be resolved as they appear. If a bug is serious enough to downstream to Debian, I would be happy to apply a patch before the next upstream release.

@TinCanTech
Copy link
Collaborator

With a planned release for September 2024, I can easily package easy-rsa 3.2.1-1 before the next stable Debian release

That is excellent news. EasyRSA v3.2.1 is intended to be a long term stable release.

@TinCanTech TinCanTech removed this from the v3.2.1 milestone Aug 20, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@ecrist ecrist

Labels
packaging Priority Acknowledged priority
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@sdavids @ecrist @TinCanTech @linqigang888