Client: [OBS] [Ubuntu 16.04] repository is insufficiently signed

[rabauke]

Since a few days I get the warning

W: gpgv:/var/lib/apt/lists/download.opensuse.org_repositories_isv:_ownCloud:_desktop_Ubuntu%5f15.10_Release.gpg: The repository is insufficiently signed by key F9EA4996747310AE79474F44977C43A8BA684223 (weak digest)

when running »apt-get update« on Ubuntu 16.04. This may be due to recent changes in apt, see
http://www.pro-linux.de/news/1/23358/debian-und-ubuntu-vertrauen-sha1-nicht-mehr.html or
https://juliank.wordpress.com/2016/03/15/clarifications-and-updates-on-apt-sha1/

[danimo]

@rabauke There are no packages for 16.04. Once OBS has support for 16.04, this problem will supposedly be solved. Anyway, you need to raise this issue with the OBS folks. I opened https://github.com/openSUSE/open-build-service/issues/1648.

[rabauke]

@danimo Indeed, I am using the repository for Ubuntu 15.10 on Ubuntu 16.04. The owncloud client is working well also on Ubuntu 16.04.

[danimo]

Well, in theory... :)

[ghost]

Ref to the upstream bugreport: https://github.com/openSUSE/obs-sign/issues/5 and the one at core: https://github.com/owncloud/core/issues/23599

[rloutrel]

I have seen that the open build service had been updated to fix this problem (https://github.com/openSUSE/open-build-service/commit/2b3f4890e743691b3a880631d562d2a130d79dc7)

I am not really understanding who is controlling this for owncloud. Can I help in any way to update the tooling for the owncloud repository?

[dragotin]

@rloutrel This packages are built on openSUSEs OBS instance. So if it is fixed there, maybe its not yet deployed?

[jnweiger]

The fix is public for obs, apparently it is not yet deployed in build.opensuse.org
If there is something in the config, that we can control ourselves, please let me know.
I'll ping SUSE and see what is missing.

[dragotin]

Seems to be all set, closing, please reopen if not ok.

[Bubu]

This is still not working for me. I followed the instruction here: https://software.opensuse.org/download/package?project=isv:ownCloud:desktop&package=owncloud-client

And then I still get this:

Get:10 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04  Release [1.023 B]
Get:11 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04  Release.gpg [189 B]
Get:12 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04  Packages [3.100 B]
Fetched 4.312 B in 0s (6.113 B/s)      
Reading package lists... Done
W: http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04/Release.gpg: Signature by key F9EA4996747310AE79474F44977C43A8BA684223 uses weak digest algorithm (SHA1)

[keithf4]

Still not working for me either. On Linux Mint 18 (based on Ubuntu 16.04)

$ sudo apt-get update
[...]             
Ign:11 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04  InRelease            
Hit:12 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04  Release              
[...]
W: http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04/Release.gpg: Signature by key F9EA4996747310AE79474F44977C43A8BA684223 uses weak digest algorithm (SHA1)

[ad-m]

@dragotin : Still not working for me. On Ubuntu 16.04:

$ sudo apt-get update | grep 'ownCloud'
Ign.:14 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04  InRelease
Stary:21 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04  Release
W: http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04/Release.gpg: Signature by key F9EA4996747310AE79474F44977C43A8BA684223 uses weak digest algorithm (SHA1)

[ad-m]

I would like mark that I have a few repo hosted on opensuse.org. All (exclude ownCloud) works like a charm.

 LANGUAGE="en_US.UTF-8" sudo apt-get update | grep 'opensuse.org'
Ign:4 http://download.opensuse.org/repositories/home:/Horst3180/xUbuntu_15.10  InRelease
Ign:9 http://download.opensuse.org/repositories/home:/jgeboski/xUbuntu_16.04 ./ InRelease
Ign:21 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04  InRelease
Hit:23 http://download.opensuse.org/repositories/home:/Horst3180/xUbuntu_15.10  Release
Hit:25 http://download.opensuse.org/repositories/home:/jgeboski/xUbuntu_16.04 ./ Release
Hit:27 http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04  Release
W: http://download.opensuse.org/repositories/isv:/ownCloud:/desktop/Ubuntu_16.04/Release.gpg: Signature by key F9EA4996747310AE79474F44977C43A8BA684223 uses weak digest algorithm (SHA1)

[ghost]

@ad-m You can follow https://github.com/owncloud/client/issues/5055 which is still open and acknowledged by the repository maintainer.