11

I'am getting this kind of message while updating my ubuntu 16.04 LTS:

W: http://dl.google.com/linux/chrome/deb/dists/stable/Release.gpg: Signature by key 4CCA1EAF950CEE4AB83976DCA040830F7FAC5991 uses weak digest algorithm (SHA1)
W: http://dl.google.com/linux/chrome/deb/dists/stable/Release.gpg: Signature by key 3B068FB4789ABE4AEFA3BB491397BC53640DB551 uses weak digest algorithm (SHA1)

Can anyone help me?

Improve this question
2

3 Answers 3

Reset to default
12

Please note that we intend to shut off SHA1 completely on January 1, 2017.

Google Chrome's repositories is half-broken since March 18th 2016. So it is issuing the warning. The problem with the Google source is on Google's end so apt-get is just reporting the issue as a warning. This issue does not stop you from upgrading packages.

You can find the list of all broken and half broken repositories here.

You need to follow sudo apt-get update with sudo apt-get upgrade to see if any package upgrades are available.

Improve this answer
2
  • Does Google know?
    – user1603472
    May 11, 2016 at 7:57
  • 2
    Yes, All repo owners are being notified .
    – Rahul K Jha
    May 11, 2016 at 9:21
11

It's just a silly misunderstanding, caused by the hasty recognition of the development team of apt maintainers about SHA1 algorithm as obsolete. The problem is that it is directly embedded in the source code of APT, but if you're willing to spend an extra 1-2 hours on the self-assembly of the package, I can tell you how to solve this nuisance. So:

sudo aptitude install git --with-recommends

mkdir build && cd build
git clone https://anonscm.debian.org/git/apt/apt.git --recursive && cd apt && git pull && ls
gedit methods/gpgv.cc

(Other cloning URLs can be found at http://anonscm.debian.org/cgit/apt/apt.git/.)

And correct this section of code as present below:

static constexpr Digest Digests[] = {
   {Digest::State::Untrusted, "Invalid digest"},
   {Digest::State::Untrusted, "MD5"},
   {Digest::State::Trusted, "Reserved digest"},
   {Digest::State::Trusted, "Reserved digest"},
   {Digest::State::Trusted, "Reserved digest"},
   {Digest::State::Trusted, "Reserved digest"},
   {Digest::State::Trusted, "SHA1"},
   {Digest::State::Trusted, "RIPE-MD/160"},
   {Digest::State::Trusted, "SHA256"},
   {Digest::State::Trusted, "SHA384"},
   {Digest::State::Trusted, "SHA512"},
   {Digest::State::Trusted, "SHA224"},
};

Then:

dpkg-buildpackage -b -uc -us -nc -rfakeroot
cd .. && rm -vf *dbg* *doc* *dev* && sudo dpkg -i *.deb
sudo apt update
Improve this answer
3
  • 2
    That's one a hell of a solution +1... until the next update to apt?
    – Systemmanic
    May 3, 2016 at 21:36
  • Can you elaborate why you think SHA1 is still secure? My understanding (backed up by Wikipedia, for instance) is that it is now possible to generate a collision and thus forge content different to the one that has been signed.
    – phihag
    Jun 2, 2016 at 7:10
  • Not to flog a dead horse, but how does the possibility of manufactured SHA1 collisions, which would have to be preceded by a breach of repository security, compare in magnitude to the SNAFU of breaking security updates (notably a widely used web browser)?
    – andy.holmes
    Sep 12, 2016 at 23:14
-1

I have same problem.

try to uninstall chrome then download and install from website. after you reinstall the problem will gone.

This work for me on Ubuntu 16.04

Improve this answer
1
  • 3
    -1 This is just a warning, so no action is necessary. In any case, with the next update, the warning will still appear, even after reinstallation.
    – phihag
    Jun 2, 2016 at 7:11

Not the answer you're looking for? Browse other questions tagged .