Browse code

Use sha512 when gpg signing builds

Signed-off-by: Derek McGowan <derek@mcgstyle.net> (github: dmcgowan)

Derek McGowan authored on 2016/11/05 01:45:13
Showing 3 changed files
... ...
@@ -114,7 +114,7 @@ for dir in bundles/$VERSION/build-deb/*/; do
114 114
 			# if we have a $GPG_PASSPHRASE we may as well
115 115
 			# dpkg-sign before copying the deb into the pool
116 116
 			if [ ! -z "$GPG_PASSPHRASE" ]; then
117
-				dpkg-sig -g "--no-tty --passphrase '$GPG_PASSPHRASE'" \
117
+				dpkg-sig -g "--no-tty  --digest-algo 'sha512' --passphrase '$GPG_PASSPHRASE'" \
118 118
 					-k "$GPG_KEYID" --sign builder "$tempdir/$d"
119 119
 			fi
120 120
 			mv "$tempdir/$d" "$APTDIR/pool/$component/d/docker-engine/"
... ...
@@ -59,7 +59,7 @@ for dir in bundles/$VERSION/build-rpm/*/; do
59 59
 			--define "_gpg_name $GPG_KEYID" \
60 60
 			--define "_signature gpg" \
61 61
 			--define "__gpg_check_password_cmd /bin/true" \
62
-			--define "__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --passphrase '$GPG_PASSPHRASE' --no-secmem-warning -u '%{_gpg_name}' --sign --detach-sign --output %{__signature_filename} %{__plaintext_filename}" \
62
+			--define "__gpg_sign_cmd %{__gpg} gpg --batch --no-armor --digest-algo 'sha512' --passphrase '$GPG_PASSPHRASE' --no-secmem-warning -u '%{_gpg_name}' --sign --detach-sign --output %{__signature_filename} %{__plaintext_filename}" \
63 63
 			--resign "${RPMFILE[@]}"
64 64
 	fi
65 65
 
... ...
@@ -28,6 +28,7 @@ sign_packages(){
28 28
 		for F in $(find $APTDIR -name Release); do
29 29
 			if test "$F" -nt "$F.gpg" ; then
30 30
 				gpg -u "$GPG_KEYID" --passphrase "$GPG_PASSPHRASE" \
31
+					--digest-algo "sha512" \
31 32
 					--armor --sign --detach-sign \
32 33
 					--batch --yes \
33 34
 					--output "$F.gpg" "$F"
... ...
@@ -35,6 +36,7 @@ sign_packages(){
35 35
 			inRelease="$(dirname "$F")/InRelease"
36 36
 			if test "$F" -nt "$inRelease" ; then
37 37
 				gpg -u "$GPG_KEYID" --passphrase "$GPG_PASSPHRASE" \
38
+					--digest-algo "sha512" \
38 39
 					--clearsign \
39 40
 					--batch --yes \
40 41
 					--output "$inRelease" "$F"
... ...
@@ -51,6 +53,7 @@ sign_packages(){
51 51
 		for F in $(find $YUMDIR -name repomd.xml); do
52 52
 			if test "$F" -nt "$F.asc" ; then
53 53
 				gpg -u "$GPG_KEYID" --passphrase "$GPG_PASSPHRASE" \
54
+					--digest-algo "sha512" \
54 55
 					--armor --sign --detach-sign \
55 56
 					--batch --yes \
56 57
 					--output "$F.asc" "$F"