Hello,

I tried to install a compiler from emdebian because there is no
corresponding version in debian main archives and

 - apt warns that the source uses SHA1 hash
 - the package is shown as untrusted

Since no exploit is known for sha1 apt (and aptitude) should show
warning about weak hash but not show the packages as untrusted.

I canot tell totally unsigned packages from packages which use hash that
Debian maintainers somehow dislike.

This is unacceptable with many archives around using these hashes.

Thanks

Michal

Control: severity -1 wishlist

001. Release file signed with GPG signature using SHA1
010. Release file containing no SHA256/SHA512 field for an index
100. Packages file containing no SHA256/SHA512 field for a package

And what happens is:
  001 => warns about repository/release file
  010 => errors about repository/release file
  100 => gives a hash sum mismatch AFAIUI

So you have both issues 001 and 100 with that repository, or what
do you mean by package is untrusted?

For the vast majority of SHA1 issues, that's the case. Only a small
minority of repositories is affected by the change in a strong way.

It's not about dislike. It's about having SHA1 repositories for 5 years
if we don't deprecate it now (due to Ubuntu LTS shipping that APT for 5
years).

We need to do some more work to get weakly signed repositories
treated as some form of untrusted, I'd expect that to arrive in the
next months.

We also need to generally rethink untrusted repository handling,
currently we have some magic flags like --allow-unauthenticated
and (--no)-allow-insecure-repositories; it would be much better
to make those configurable per source instead, and I'd like
the following behavior:

 Turn related errors into warnings

Following the slogan: Complain as hard as possible, even if the user
tells us it's OK. Maybe we can have some

I-Really-Know-What-I-Am-Doing-Do-Not-Warn-Me-About-Security

field for people to really disable even the warnings. If we do, it
should be unreasonable long, a pain to write, and convey what it is
doing in a very loud way, so users get the message. Otherwise people
write guides like:

""
Please add
   deb [trusted=yes] http://example.com/debian stable main
to your sources.list
""

If it says:

""
Please add
   deb [trusted=yes,ireallytrustthisevenifitisinsecuredonotwarnmeabout it=true] http://example.com/debian stable main
to your sources.list
""

people are less likely to just do it...

s/many/small minority of/

Dear Maintainer,

This also affects pulling old stuff from snapshots.debian.org ... which
is a lot more useful when you can put `[check-valid-until=no]` in
sources.list, which is only in recent apt.