Make SHA256 the default HashAlgorithm.

As of 2020, attacks against SHA1 need to be considered practical. It is therefore recommended to move on to a more secure hash algorithm. Other OpenPGP implementations, such as Sequoia-PGP moved on as well. See e.g. https://sequoia-pgp.org/blog/2023/02/01/202302-happy-sha1-day/
eclipse · Apr 2, 2024 · 840f390 · 840f390
1 parent 890e443
commit 840f390
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 5 deletions.
diff --git a/rpm/src/main/java/org/eclipse/packager/rpm/HashAlgorithm.java b/rpm/src/main/java/org/eclipse/packager/rpm/HashAlgorithm.java
@@ -42,7 +42,7 @@ public String getId() {
      * <p>
      * This method will return the hash algorithm as specified by the
      * parameter "name". If this parameter is {@code null} or an empty
-     * string, then the default algorithm {@link #SHA1} will be returned. If
+     * string, then the default algorithm {@link #SHA256} will be returned. If
      * algorithm is an invalid name, then an exception is thrown.
      * </p>
      *
@@ -52,7 +52,7 @@ public String getId() {
      */
     public static HashAlgorithm from(final String name) {
         if (name == null || name.isEmpty()) {
-            return SHA1;
+            return SHA256;
         }
 
         return HashAlgorithm.valueOf(name);

diff --git a/rpm/src/main/java/org/eclipse/packager/rpm/signature/RsaHeaderSignatureProcessor.java b/rpm/src/main/java/org/eclipse/packager/rpm/signature/RsaHeaderSignatureProcessor.java
@@ -50,7 +50,7 @@ public RsaHeaderSignatureProcessor(final PGPPrivateKey privateKey, final HashAlg
     }
 
     public RsaHeaderSignatureProcessor(final PGPPrivateKey privateKey) {
-        this(privateKey, HashAlgorithmTags.SHA1);
+        this(privateKey, HashAlgorithmTags.SHA256);
     }
 
     @Override

diff --git a/rpm/src/main/java/org/eclipse/packager/rpm/signature/RsaSignatureProcessor.java b/rpm/src/main/java/org/eclipse/packager/rpm/signature/RsaSignatureProcessor.java
@@ -53,7 +53,7 @@ public RsaSignatureProcessor(final PGPPrivateKey privateKey, final HashAlgorithm
     }
 
     public RsaSignatureProcessor(final PGPPrivateKey privateKey) {
-        this(privateKey, HashAlgorithmTags.SHA1);
+        this(privateKey, HashAlgorithmTags.SHA256);
     }
 
     @Override

diff --git a/rpm/src/main/java/org/eclipse/packager/rpm/yum/RepositoryCreator.java b/rpm/src/main/java/org/eclipse/packager/rpm/yum/RepositoryCreator.java
@@ -440,7 +440,7 @@ public Builder setSigning(final Function<OutputStream, OutputStream> signingStre
         }
 
         public Builder setSigning(final PGPPrivateKey privateKey) {
-            return setSigning(privateKey, HashAlgorithmTags.SHA1);
+            return setSigning(privateKey, HashAlgorithmTags.SHA256);
         }
 
         public Builder setSigning(final PGPPrivateKey privateKey, final HashAlgorithm hashAlgorithm) {