[
https://issues.apache.org/jira/browse/SOLR-14649?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17157734#comment-17157734
]
Robert Muir commented on SOLR-14649:
------------------------------------
ok looking at the code here, its signing with SHA1WithRSA. but there's also a
lot of other stuff going on here, maybe more problems get found in the future.
In general, I feel inventing any package manager is asking for problems. But
for sure, if you can't fix bugs going forwards and also balance back compat it
will not really work out. So I think its worth making sure you can do that,
e.g. create a new format that is more secure, and maybe have some flags
(disabled by default ideally) that a user can enable if they want to support
older insecure formats. Good error messages are important.
> Package manager should use SHA512, not SHA1
> -------------------------------------------
>
> Key: SOLR-14649
> URL: https://issues.apache.org/jira/browse/SOLR-14649
> Project: Solr
> Issue Type: Improvement
> Security Level: Public(Default Security Level. Issues are Public)
> Reporter: Ishan Chattopadhyaya
> Priority: Major
>
> Due to a massive oversight, we only support SHA1 based package signing. We
> should immediately switch to SHA512. Post that, all existing packages must be
> re-signed with SHA512.
> I'll propose this for a 8.6.1 breakfix release.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org
For additional commands, e-mail: issues-h...@lucene.apache.org
