From 4a84deda7489f668cd833b59daeb504cbd87fa2b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= Date: Sat, 2 May 2020 23:53:25 +0200 Subject: [PATCH] doc: Recommend against SHA1 OpenPGP signatures. * doc/contributing.texi (Commit Access): Recommend against SHA1 signatures. --- doc/contributing.texi | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/doc/contributing.texi b/doc/contributing.texi index 0ec7a48b96..9583120742 100644 --- a/doc/contributing.texi +++ b/doc/contributing.texi @@ -1187,6 +1187,16 @@ the OpenPGP key you will use to sign commits, and giving its fingerprint (see below). See @uref{https://emailselfdefense.fsf.org/en/}, for an introduction to public-key cryptography with GnuPG. +@c See . +Set up GnuPG such that it never uses the SHA1 hash algorithm for digital +signatures, which is known to be unsafe since 2019, for instance by +adding the following line to @file{~/.gnupg/gpg.conf} (@pxref{GPG +Esoteric Options,,, gnupg, The GNU Privacy Guard Manual}): + +@example +digest-algo sha512 +@end example + @item Maintainers ultimately decide whether to grant you commit access, usually following your referrals' recommendation.