Revert "ci, docker: Fix LLVM repository signature failure"
What the developer wrote
Authored by Hennadii Stepanov
Revert "ci, docker: Fix LLVM repository signature failure"
This reverts commit 0ffb1749a5811bb63902f00c9fa73b49588d0557.
What changed, and why it matters
This commit removes a temporary workaround in the project's CI Docker build file. The workaround had relaxed a PGP signature policy check so that an older LLVM repository signing key would still be accepted by Debian's package manager during automated testing image builds. Removing the workaround simply restores the normal, stricter policy. There is no direct security vulnerability in the project's own code, and no runtime software is changed.
No action required. This is a healthy cleanup of a temporary CI workaround. Monitor CI image builds to ensure the LLVM repository signature is now accepted without the workaround; if failures recur, address them by updating the key or repository configuration rather than weakening PGP policy.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The reverted change was a temporary sed-based modification to /usr/share/apt/default-sequoia.config that extended the SHA-1 second-preimage resistance deadline to 9999-01-01. It was added to keep apt from rejecting the LLVM apt repository’s legacy PGP signature while LLVM rotated their key (llvm/llvm-project#153385). This commit reverts that workaround, returning the Sequoia config to its default. The change is confined to ci/linux-debian.Dockerfile and affects only CI image builds.
Changed components
ci/linux-debian.DockerfileInspect captured patch +0 / −3
diff --git a/ci/linux-debian.Dockerfile b/ci/linux-debian.Dockerfile
index a862f1b..a575d9b 100644
--- a/ci/linux-debian.Dockerfile
+++ b/ci/linux-debian.Dockerfile
@@ -67,9 +67,6 @@ RUN \
wget -qO- https://apt.llvm.org/llvm-snapshot.gpg.key | tee /etc/apt/trusted.gpg.d/apt.llvm.org.asc && \
# Add repository for this Debian release
. /etc/os-release && echo "deb http://apt.llvm.org/${VERSION_CODENAME} llvm-toolchain-${VERSION_CODENAME} main" >> /etc/apt/sources.list && \
- # Temporarily work around Sequoia PGP policy deadline for legacy repositories.
- # See https://github.com/llvm/llvm-project/issues/153385.
- sed -i 's/\(sha1\.second_preimage_resistance =\).*/\1 9999-01-01/' /usr/share/apt/default-sequoia.config && \
apt-get update && \
# Determine the version number of the LLVM development branch
LLVM_VERSION=$(apt-cache search --names-only '^clang-[0-9]+$' | sort -V | tail -1 | cut -f1 -d" " | cut -f2 -d"-" ) && \
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.