ci, docker: Fix LLVM repository signature failure
What the developer wrote
Authored by Hennadii Stepanov
ci, docker: Fix LLVM repository signature failure
The LLVM apt repository uses legacy SHA1 signatures which are now
rejected by the stricter Sequoia PGP policy.
This change extends the 'sha1.second_preimage_resistance' cutoff date to
9999-01-01 in the default Sequoia config. This effectively whitelists
the legacy signature algorithm, preventing "OpenPGP signature
verification failed" errors during `apt-get update`.
See https://github.com/llvm/llvm-project/issues/153385.
What changed, and why it matters
This commit changes a CI Docker build script so that an older SHA-1-based PGP signature from the LLVM apt repository is still accepted. It is a build-infrastructure workaround, not a change to the secp256k1 cryptographic code, and it does not introduce a vulnerability in the library itself.
No immediate security action is required for libsecp256k1. Monitor upstream LLVM issue #153385 and remove the workaround once LLVM's apt repository migrates to a stronger signature algorithm. Consider pinning the workaround to a specific, shorter cutoff date if feasible, and ensure the CI image is rebuilt from trusted base images.
Security signals we found
Configuration relaxation of PGP signature policy in CI environment
Use of SHA-1 signature algorithm whitelisted by date extension
Build-infrastructure-only change with no effect on shipped library
Evidence from the diff
The Dockerfile used for CI now edits /usr/share/apt/default-sequoia.config to extend the sha1.second_preimage_resistance cutoff to 9999-01-01. This disables Sequoia’s deadline-based rejection of SHA-1 OpenPGP signatures for apt, allowing apt-get update to succeed against apt.llvm.org, whose repository metadata is still signed with legacy SHA-1. The change is scoped to the CI container image and does not alter secp256k1 source code, build outputs, or runtime behavior.
Changed components
ci/linux-debian.DockerfileInspect captured patch +3 / −0
diff --git a/ci/linux-debian.Dockerfile b/ci/linux-debian.Dockerfile
index a575d9b..a862f1b 100644
--- a/ci/linux-debian.Dockerfile
+++ b/ci/linux-debian.Dockerfile
@@ -67,6 +67,9 @@ RUN \
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc && \
# Add repository for this Debian release
. /etc/os-release && echo "deb http://apt.llvm.org/${VERSION_CODENAME} llvm-toolchain-${VERSION_CODENAME} main" >> /etc/apt/sources.list && \
+ # Temporarily work around Sequoia PGP policy deadline for legacy repositories.
+ # See https://github.com/llvm/llvm-project/issues/153385.
+ sed -i 's/\(sha1\.second_preimage_resistance =\).*/\1 9999-01-01/' /usr/share/apt/default-sequoia.config && \
apt-get update && \
# Determine the version number of the LLVM development branch
LLVM_VERSION=$(apt-cache search --names-only '^clang-[0-9]+$' | sort -V | tail -1 | cut -f1 -d" " | cut -f2 -d"-" ) && \
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.