summaryrefslogtreecommitdiff
path: root/doc
diff options
context:
space:
mode:
authorLudovic Courtès <ludo@gnu.org>2020-05-02 23:53:25 +0200
committerLudovic Courtès <ludo@gnu.org>2020-05-04 09:56:14 +0200
commit4a84deda7489f668cd833b59daeb504cbd87fa2b (patch)
tree6275a139b22ec7070b16f40c96051bb0ec0a28c4 /doc
parent84133320b8fb70f093831203a028ed2ffb6082ce (diff)
doc: Recommend against SHA1 OpenPGP signatures.
* doc/contributing.texi (Commit Access): Recommend against SHA1 signatures.
Diffstat (limited to 'doc')
-rw-r--r--doc/contributing.texi10
1 files changed, 10 insertions, 0 deletions
diff --git a/doc/contributing.texi b/doc/contributing.texi
index 0ec7a48b96..9583120742 100644
--- a/doc/contributing.texi
+++ b/doc/contributing.texi
@@ -1187,6 +1187,16 @@ the OpenPGP key you will use to sign commits, and giving its fingerprint
(see below). See @uref{https://emailselfdefense.fsf.org/en/}, for an
introduction to public-key cryptography with GnuPG.
+@c See <https://sha-mbles.github.io/>.
+Set up GnuPG such that it never uses the SHA1 hash algorithm for digital
+signatures, which is known to be unsafe since 2019, for instance by
+adding the following line to @file{~/.gnupg/gpg.conf} (@pxref{GPG
+Esoteric Options,,, gnupg, The GNU Privacy Guard Manual}):
+
+@example
+digest-algo sha512
+@end example
+
@item
Maintainers ultimately decide whether to grant you commit access,
usually following your referrals' recommendation.