Ability to add signature with SHA256

[mkbaldwin]

Is it possible to add a signature based on SHA256 rather than SHA1? RHEL 7 now includes these signatures by default when signing with the command line utility. Plus, these are stronger hashes required by some security policies. Is this a feature than can be added?

[BClark09]

Hi, it looks like signatures are still using SHA1. Generated RPM packages report as having bad signatures on CentOS9:

[...]
warning: Signature not supported. Hash algorithm SHA1 not available.
    Header V4 RSA/SHA1 Signature, key ID 82573a7c: BAD
    Header SHA256 digest: OK
    Header SHA1 digest: OK
[...]

These are fixed in ChannelWrapper.java but changing to SHA256 (or other from HashAlgorithmTags seems to fix the issue.

redline/src/main/java/org/redline_rpm/ChannelWrapper.java

Line 20 in 15afff5

import static org.bouncycastle.bcpg.HashAlgorithmTags.SHA1;

redline/src/main/java/org/redline_rpm/ChannelWrapper.java

Line 126 in 15afff5

BcPGPContentSignerBuilder contentSignerBuilder = new BcPGPContentSignerBuilder( algorithm, SHA1 );