# Key import error: "Signature not supported. Hash algorithm SHA1 not available." **URL:** \ **Category:** Rocky Linux Help & Support\ **Created:** [July 15, 2024, 3:40pm UTC](https://forums.rockylinux.org/t/key-import-error-signature-not-supported-hash-algorithm-sha1-not-available/15069 "2024-07-15T15:40:08Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\ **Post date:** [July 15, 2024, 3:40pm UTC](https://forums.rockylinux.org/t/key-import-error-signature-not-supported-hash-algorithm-sha1-not-available/15069/1 "2024-07-15T15:40:08Z")
Hi, I’m currently properly rebuilding my own RPM package repo for the stuff that’s not available in any of the third-party repos. Currently I have three packages for Rocky Linux 8 here: [https://www.microlinux.fr/pub/rockylinux/](https://www.microlinux.fr/pub/rockylinux/) I just ran into a strange problem when setting up the repo for Rocky Linux 9. On the client machines, I use the following stance for importing the repository’s GPG key: ```auto - name: Import Microlinux GPG key ansible.builtin.rpm_key: key: https://www.microlinux.fr/pub/rockylinux/RPM-GPG-KEY state: present ``` On Rocky Linux 8, this works perfectly. On Rocky Linux 9, Ansible spews back the following error: ```auto TASK [repo_microlinux : Import Microlinux GPG key] *********************************************************** fatal: [rocky-el9.microlinux.lan]: FAILED! => {"changed": false, "msg": "warning: Signature not supported. Has h algorithm SHA1 not available.\nerror: /tmp/tmpaupj3klo: key 1 import failed.\n"} ``` On a side note: my main workstation is running Rocky Linux 8, and I’m building packages for both Rocky Linux 8 and 9 using Mock. Any suggestions ? ---
**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\ **Post date:** [July 15, 2024, 3:46pm UTC](https://forums.rockylinux.org/t/key-import-error-signature-not-supported-hash-algorithm-sha1-not-available/15069/2 "2024-07-15T15:46:07Z")
Recommended: Generate new keys that are not sha1. Alternative (not recommended): Update your crypto policies to allow sha1. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [July 15, 2024, 3:58pm UTC](https://forums.rockylinux.org/t/key-import-error-signature-not-supported-hash-algorithm-sha1-not-available/15069/3 "2024-07-15T15:58:46Z")
The latter would be with: ```auto update-crypto-policies --set DEFAULT:SHA1 ``` as described in [Chapter 3. Using system-wide cryptographic policies | Red Hat Product Documentation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening) But, since _you_ make the keys, you can and should make the “better” keys. ---
**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\ **Post date:** [July 15, 2024, 4:28pm UTC](https://forums.rockylinux.org/t/key-import-error-signature-not-supported-hash-algorithm-sha1-not-available/15069/4 "2024-07-15T16:28:20Z")
> [@jlehtone](#): > > But, since _you_ make the keys, you can and should make the “better” keys. I’m not sure how I would go about that. I have a local GPG key on my workstation that I’ve had for a few years: ```auto $ gpg --list-secret-keys /home/kikinovak/.gnupg/pubring.kbx ---------------------------------- sec rsa4096 2018-04-09 [SCA] 9C4708738E37651B867DA97451F1EF3EC56945AE uid [ultime] Nicolas Kovacs uid [ultime] [jpeg image of size 15912] ssb rsa4096 2018-04-09 [E] ``` I exported this key like this: ```auto gpg --export --armour info@microlinux.fr > RPM-GPG-KEY ``` And then I uploaded it to my repo. I googled around a bit and found workarounds which consisted in editing `~/.rpmmacros`. But as far as I understand, this has nothing to do with my key. I admit I’m confused. What exactly is the bad part here, and how would I “make a better key”? ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [July 15, 2024, 5:13pm UTC](https://forums.rockylinux.org/t/key-import-error-signature-not-supported-hash-algorithm-sha1-not-available/15069/5 "2024-07-15T17:13:56Z")
> [@microlinux](#): > > I googled around a bit and found workarounds which consisted in editing `~/.rpmmacros`. But as far as I understand, this has nothing to do with my key. My bad. I did not check what “new keys” by @label means here. The issue seems to be that the _hash_ created by GPG when _signing_ a package is SHA-1. You probably saw the same things as me, like [Enhancing RHEL Security: Understanding SHA-1 deprecation on RHEL 9](https://www.redhat.com/en/blog/rhel-security-sha-1-package-signatures-distrusted-rhel-9) The “editing `~/.rpmmacros`” is thus the “key” here – to force GPG sign with something other than SHA-1. ---
**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\ **Post date:** [July 15, 2024, 5:30pm UTC](https://forums.rockylinux.org/t/key-import-error-signature-not-supported-hash-algorithm-sha1-not-available/15069/6 "2024-07-15T17:30:02Z")
What I still don’t get: in my case, Ansible fails at an earlier stage when importing my public GPG key. And this key is in no way concerned by `~/.rpmmacros`. I’m still confused. ---
**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\ **Post date:** [July 15, 2024, 9:06pm UTC](https://forums.rockylinux.org/t/key-import-error-signature-not-supported-hash-algorithm-sha1-not-available/15069/7 "2024-07-15T21:06:50Z")
Is the public GPG also a hash from the secret key? ---
**Author:** ![Ritov](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@Ritov](https://forums.rockylinux.org/u/Ritov)\ **Post date:** [July 15, 2024, 9:20pm UTC](https://forums.rockylinux.org/t/key-import-error-signature-not-supported-hash-algorithm-sha1-not-available/15069/8 "2024-07-15T21:20:43Z")
> [@microlinux](#): > > What I still don’t get: in my case, Ansible fails at an earlier stage What is the output for your key of: ```auto gpg --export-options export-minimal --export '' | gpg --list-packets | grep -A 2 signature | grep 'digest algo' ``` If its `digest algo 2` then you should recreate your key-pair again with a proper **gnupg** configuration ---
**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\ **Post date:** [July 16, 2024, 5:01am UTC](https://forums.rockylinux.org/t/key-import-error-signature-not-supported-hash-algorithm-sha1-not-available/15069/9 "2024-07-16T05:01:12Z")
As far as I can tell, this was an old GPG key I had created under CentOS 7. I just generated a new GPG key under Rocky Linux 8 and signed my packages with it, and everything’s fine now. Rocky Linux 9 can import the key without a hiccup. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\ **Post date:** [September 14, 2024, 5:02am UTC](https://forums.rockylinux.org/t/key-import-error-signature-not-supported-hash-algorithm-sha1-not-available/15069/10 "2024-09-14T05:02:02Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.