{"action":"created","issue":{"url":"https://api.github.com/repos/piwik/piwik-package/issues/50","repository_url":"https://api.github.com/repos/piwik/piwik-package","labels_url":"https://api.github.com/repos/piwik/piwik-package/issues/50/labels{/name}","comments_url":"https://api.github.com/repos/piwik/piwik-package/issues/50/comments","events_url":"https://api.github.com/repos/piwik/piwik-package/issues/50/events","html_url":"https://github.com/piwik/piwik-package/issues/50","id":196903332,"number":50,"title":"Use stronger Debian package signing key","user":{"login":"joelpurra","id":1398544,"avatar_url":"https://avatars.githubusercontent.com/u/1398544?v=3","gravatar_id":"","url":"https://api.github.com/users/joelpurra","html_url":"https://github.com/joelpurra","followers_url":"https://api.github.com/users/joelpurra/followers","following_url":"https://api.github.com/users/joelpurra/following{/other_user}","gists_url":"https://api.github.com/users/joelpurra/gists{/gist_id}","starred_url":"https://api.github.com/users/joelpurra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/joelpurra/subscriptions","organizations_url":"https://api.github.com/users/joelpurra/orgs","repos_url":"https://api.github.com/users/joelpurra/repos","events_url":"https://api.github.com/users/joelpurra/events{/privacy}","received_events_url":"https://api.github.com/users/joelpurra/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-12-21T10:56:34Z","updated_at":"2016-12-26T03:34:43Z","closed_at":null,"body":"Following the steps to install [the official `piwik` Debian package](https://debian.piwik.org/) on Debian testing (stretch), I am unable to get past `apt-get update`, which gives me a GPG error.\r\n\r\n```shell\r\nsudo apt-get update\r\n```\r\n\r\n```text\r\nHit:1 http://ftp.acc.umu.se/debian stretch InRelease\r\nIgn:2 https://debian.piwik.org piwik InRelease\r\nHit:3 https://debian.piwik.org piwik Release\r\nHit:4 http://security.debian.org/debian-security stretch/updates InRelease\r\nGet:5 https://debian.piwik.org piwik Release.gpg [197 B]\r\nIgn:5 https://debian.piwik.org piwik Release.gpg\r\nFetched 197 B in 0s (294 B/s)\r\nReading package lists... Done\r\nW: GPG error: https://debian.piwik.org piwik Release: The following signatures were invalid: 1FD752571FE36FF23F78F91B81E2E78B66FED89E\r\nW: The repository 'https://debian.piwik.org piwik Release' is not signed.\r\nN: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.\r\nN: See apt-secure(8) manpage for repository creation and user configuration details.\r\n```\r\n\r\nWhile vague, this seems to be the issue: `The following signatures were invalid: 1FD752571FE36FF23F78F91B81E2E78B66FED89E`. Note that they fingerprint is correct according to `apt-key list` (see output below).\r\n\r\nI believe that the problem is that the PGP key used to sign the repository uses DSA 1024 bit, as there's a [push to abandon weak/old (digest) algorithms](https://wiki.debian.org/Teams/Apt/Sha1Removal) before January 1, 2017. Official Debian repos use RSA 4096. Here's a quote:\r\n\r\n> [Fixing half-broken repositories](https://wiki.debian.org/Teams/Apt/Sha1Removal#Fixing_half-broken_repositories): Repositories with DSA keys need to be migrated to RSA first. Migrating from DSA to RSA is best done by signing the repository with two keys (old and new one) and shipping the new one to the users.\r\n\r\n\r\nWould it be possible to follow the recommendation and transition to a stronger repository key?\r\n\r\n\r\n---\r\n\r\nJust to clarify that the Piwik repository key has been added to `apt` on my machine, according to the official instructions.\r\n\r\n```shell\r\nsudo apt-key list\r\n```\r\n\r\n```text\r\n/etc/apt/trusted.gpg\r\n--------------------\r\npub   dsa1024 2013-12-19 [SC]\r\n      1FD7 5257 1FE3 6FF2 3F78  F91B 81E2 E78B 66FE D89E\r\nuid           [ unknown] Piwik Open Source Analytics (Debian Package) <debian@piwik.org>\r\nsub   elg4096 2013-12-19 [E]\r\n\r\n/etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg\r\n----------------------------------------------------------\r\npub   rsa4096 2014-11-21 [SC] [expires: 2022-11-19]\r\n      126C 0D24 BD8A 2942 CC7D  F8AC 7638 D044 2B90 D010\r\nuid           [ unknown] Debian Archive Automatic Signing Key (8/jessie) <ftpmaster@debian.org>\r\n\r\n(... several keys follow ...)\r\n```"},"comment":{"url":"https://api.github.com/repos/piwik/piwik-package/issues/comments/269155150","html_url":"https://github.com/piwik/piwik-package/issues/50#issuecomment-269155150","issue_url":"https://api.github.com/repos/piwik/piwik-package/issues/50","id":269155150,"user":{"login":"mattab","id":466765,"avatar_url":"https://avatars.githubusercontent.com/u/466765?v=3","gravatar_id":"","url":"https://api.github.com/users/mattab","html_url":"https://github.com/mattab","followers_url":"https://api.github.com/users/mattab/followers","following_url":"https://api.github.com/users/mattab/following{/other_user}","gists_url":"https://api.github.com/users/mattab/gists{/gist_id}","starred_url":"https://api.github.com/users/mattab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattab/subscriptions","organizations_url":"https://api.github.com/users/mattab/orgs","repos_url":"https://api.github.com/users/mattab/repos","events_url":"https://api.github.com/users/mattab/events{/privacy}","received_events_url":"https://api.github.com/users/mattab/received_events","type":"User","site_admin":false},"created_at":"2016-12-26T03:34:42Z","updated_at":"2016-12-26T03:34:42Z","body":"Thanks for the report. @aureq maybe you would be able to investigate this?"}}
{"actor":{"display_login":"mattab"}}