Revert "ci: Treat SHA1 LLVM signing key as warning"
What the developer wrote
Authored by will
Revert "ci: Treat SHA1 LLVM signing key as warning"
This reverts commit 3c8f5e48f710313de78bcbfafd09fed71890d754.
What changed, and why it matters
This commit removes a temporary workaround in Bitcoin Core's automated testing setup that relaxed a security policy for checking the cryptographic signature on LLVM's software repository. The workaround was added because LLVM's signing key still used the older SHA1 hash algorithm, which newer Linux systems began rejecting. Now that LLVM has fixed its key, the workaround is no longer needed and is being removed. This is a cleanup change that restores normal, stricter security checks in the continuous integration (CI) environment. It does not change the Bitcoin Core software that users run.
No user action required. This is a CI hardening/cleanup change. Operators of CI infrastructure should ensure the LLVM apt repository key now validates under default Sequoia policy; if CI builds fail, verify the upstream LLVM key has been updated as indicated by the referenced issue.
Security signals we found
Reverts a temporary downgrade of PGP signature verification policy
Removes SHA1 deadline extension in CI apt configuration
Restores stricter Sequoia PGP policy for LLVM repository key validation
No change to consensus, networking, wallet, or node runtime code
Evidence from the diff
The reverted change modified /usr/share/apt/default-sequoia.config to push the SHA1 second-preimage resistance deadline to the year 9999, effectively disabling Sequoia/apt’s enforcement of SHA1 deprecation when adding the LLVM apt repository in CI. The revert removes that sed-based policy relaxation. The commit message references LLVM issue #153385, indicating the upstream key issue was resolved. The change is confined to ci/test/01_base_install.sh and affects only CI container/image builds.
Changed components
ci/test/01_base_install.shInspect captured patch +0 / −5
diff --git a/ci/test/01_base_install.sh b/ci/test/01_base_install.sh
index d62221a7..ea1ce07b 100755
--- a/ci/test/01_base_install.sh
+++ b/ci/test/01_base_install.sh
@@ -22,11 +22,6 @@ if [ -n "$DPKG_ADD_ARCH" ]; then
fi
if [ -n "${APT_LLVM_V}" ]; then
- # Temporarily work around Sequoia PGP policy deadline for legacy repositories.
- # See https://github.com/llvm/llvm-project/issues/153385.
- if [ -f /usr/share/apt/default-sequoia.config ]; then
- sed -i 's/\(sha1\.second_preimage_resistance =\).*/\1 9999-01-01/' /usr/share/apt/default-sequoia.config
- fi
${CI_RETRY_EXE} apt-get update
${CI_RETRY_EXE} apt-get install curl -y
curl "https://apt.llvm.org/llvm-snapshot.gpg.key" | tee "/etc/apt/trusted.gpg.d/apt.llvm.org.asc"
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.