ci: Treat SHA1 LLVM signing key as warning
What the developer wrote
Authored by will
ci: Treat SHA1 LLVM signing key as warning
The current SHA1 LLVM signing key is considered not secure since
2026-02-01T00:00:00Z which makes this run fail when downloading
packages.
See: https://github.com/llvm/llvm-project/issues/153385
Apply the fix from the issue to temporarily to treat this error as a
warning, until the upstream key can be updated.
This PR should be reverted once the upstream key is updated.
What changed, and why it matters
This change is a temporary workaround for a CI build script. It relaxes a security policy so that apt can still accept an older SHA1-based LLVM signing key after a deadline passed. It is not a fix for a vulnerability in Bitcoin Core itself, but it slightly weakens a cryptographic check in the automated test environment until LLVM updates its key.
No immediate action required for Bitcoin Core users. Monitor LLVM upstream key update and revert this workaround once the new key is available, as the commit itself requests.
Security signals we found
Weakens SHA1 rejection policy in CI environment
Temporary workaround for upstream signing-key issue
Modifies system PGP/Sequoia configuration in install script
No change to Bitcoin Core consensus, networking, or wallet code
Evidence from the diff
The commit modifies ci/test/01_base_install.sh to patch /usr/share/apt/default-sequoia.config, moving the sha1.second_preimage_resistance deadline to 9999-01-01. This disables Sequoia PGP’s SHA1 rejection for apt so that the LLVM apt repository’s SHA1-signed key remains usable. The commit explicitly calls this temporary and says it should be reverted once LLVM updates its key.
Changed components
ci/test/01_base_install.shInspect captured patch +5 / −0
diff --git a/ci/test/01_base_install.sh b/ci/test/01_base_install.sh
index 0ac56208..3e0bc466 100755
--- a/ci/test/01_base_install.sh
+++ b/ci/test/01_base_install.sh
@@ -22,6 +22,11 @@ if [ -n "$DPKG_ADD_ARCH" ]; then
fi
if [ -n "${APT_LLVM_V}" ]; then
+ # Temporarily work around Sequoia PGP policy deadline for legacy repositories.
+ # See https://github.com/llvm/llvm-project/issues/153385.
+ if [ -f /usr/share/apt/default-sequoia.config ]; then
+ sed -i 's/\(sha1\.second_preimage_resistance =\).*/\1 9999-01-01/' /usr/share/apt/default-sequoia.config
+ fi
${CI_RETRY_EXE} apt-get update
${CI_RETRY_EXE} apt-get install curl -y
curl "https://apt.llvm.org/llvm-snapshot.gpg.key" | tee "/etc/apt/trusted.gpg.d/apt.llvm.org.asc"
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.