Release signing key still uses SHA1

[Marek Marczykowski-Górecki]

Hi,

The key used to sign release tarballs and git tags still uses SHA1 for
its self-signature. Is updated key somewhere already?

SHA1 is starting to be rejected by some tools already, for example
sequoia-sq:

    $ sq inspect grub-dkiper.pub 
    grub-dkiper.pub: OpenPGP Certificate.

        Fingerprint: BE5C23209ACDDACEB20DB0A28C8189F1988C2166
    Public-key algo: RSA
    Public-key size: 4096 bits
      Creation time: 2017-02-05 03:43:32 UTC
    Expiration time: 2028-02-14 00:05:49 UTC (creation time + 11years 8days 2h 
22m 17s)
          Key flags: certification, signing

             Subkey: 1BE37633B1B7EA3E057CC384955D1898DC24BB87
                     Invalid: Policy rejected non-revocation signature 
(SubkeyBinding) requiring second pre-image resistance
                     because: SHA1 is not considered secure
                     Invalid: Policy rejected non-revocation signature 
(SubkeyBinding) requiring second pre-image resistance
    Public-key algo: RSA
    Public-key size: 4096 bits
      Creation time: 2017-02-05 03:43:32 UTC

             UserID: Daniel Kiper <daniel.kiper@oracle.com>

             UserID: Daniel Kiper <dkiper@net-space.pl>
                     Invalid: Policy rejected non-revocation signature 
(PositiveCertification) requiring second pre-image resistance
                     because: SHA1 is not considered secure
     Certifications: 95, use --certifications to list


-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab

signature.asc
Description: PGP signature