Sequoia breaks apt repos. How to fix it.

Para versão em português vai em: https://www.adilson.net.br/2024/12/sequoia-quebra-os-repositorios-apt-como.html

After a long time without updating this blog, I will write about a issue that happened with some systems here.

If you have not noticed. I use Debian Sid in my desktops and notebooks with lots of customizations and third party repositories.

And, on this Christimas week, some devs give a present for the apt, as shown in this last changelog:

apt (2.9.19) unstable; urgency=medium

  * Replace GnuTLS and gcrypt with OpenSSL

  * Replace GnuPG with Sequoia on supported Debian platforms

    - methods: Add new sqv method

    - debian: Add default policy to allow SHA-1 self-signatures until 2026

    - debian: Plug sqv into the package build

  * Smaller bits:

    - apt-helper: Add a hash-file helper to debug file hashing

    - Use sq in the test suite, remove apt-key

    - abicheck: Add symbol-merge.py helper

    - Symbols: Merge stable, noble, testing, unstable

 -- Julian Andres Klode <jak@debian.org>  Mon, 23 Dec 2024 12:16:19 +0100

They switched from GnuPG to Sequoia, that is an alternative PGP implementation. But this implementations has some configurations that default blocks the insecure sha-1 hash for checking crypto signiatures.

The devs also put a change on the Sequoia policy that allows sha-1 until 2026.

But you know how Debian sid is like:

There are some things that Sid breaks.

And it breaks some repos. Some errors were:

Err:39 https://packagecloud.io/slacktechnologies/slack/debian jessie InRelease

  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on DB085A08CA13B8ACB917E0F6D938EC0D038651BD is not bound:            primary key   because: No binding signature at time 2024-12-17T17:27:20Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring collision resistance   because: SHA1 is not considered secure since 2013-02-01T00:00:00Z  

  W: Falhou ao buscar https://pkgs.k8s.io/core:/stable:/v1.31/deb/InRelease  Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Policy rejected packet type  Caused by:     Signature Packet v3 is not considered secure since 2021-02-01T00:00:00Z

Even I tried to check something related below:

  apt (2.9.19) unstable; urgency=medium

  This release switches to OpenSSL for hashing and TLS, replacing the

  GnuTLS and gcrypt libraries.

  This release switches to Sequoia for OpenPGP verification on supported

  Debian platforms. A Sequoia policy override enabling SHA1 self-signatures

  until 2026 is included. To override the policy, the following environment

  variables and files are considered:

  * The APT_SEQUOIA_CRYPTO_POLICY environment variable, and failing that:

    - /etc/crypto-policies/back-ends/apt-sequoia.config,

    - /var/lib/crypto-config/profiles/current/apt-sequoia.config

  * The SEQUOIA_CRYPTO_POLICY environment variable, and failing that:

    - /etc/crypto-policies/back-ends/sequoia.config

    - /var/lib/crypto-config/profiles/current/sequoia.config

 -- Julian Andres Klode <jak@debian.org>  Mon, 23 Dec 2024 12:16:22 +0100

But these configurations didn't worked. The Sequoia documentation https://docs.rs/sequoia-policy-config/latest/sequoia_policy_config/index.html does't show a right place for this configuation and, even, ChatGPT hasn't got a right answer for this issue.

If, even, an IA knows how to configure it correctly:

Imagine a human that saw this error for the first time:

After a lot of research. I discovered where they configure apt Sequoia policies:

/usr/share/apt/default-sequoia.config

Since they didn't explain any alternative locations 😵‍💫, I will edit this file.

Update Jan 9th 2025: An anonymous reader commented about  /etc/crypto-policies/back-ends/apt-sequoia.config . This folder does not exists on my system so I have to do a

mkdir -p /etc/crypto-policies/back-ends/ 

and create apt-sequoia.config for adding the configuration below.

Inside you will find this configuration:

[hash_algorithms]

sha1.second_preimage_resistance = 2026-01-01

Try to change them to:

[hash_algorithms]

#sha1.second_preimage_resistance = 2026-01-01

sha1= 2030-01-01

[packets]

signature.v3 = 2030-01-01

I commented the first line and add sha1 with a date to 01/01/2030.

Then I put a [packet] section with signature.v3, that is also affected, with a date to 01/01/2030.

After saving this file the error vanished.

This is a temporary solution until the devs make some fixes to apt or the repositories signatures are updated to the most recent standards that are supported by Sequoia.

And, keep in mind, that SHA-1 is not safe anymore and any apt update will overwrite /usr/share/apt/default-sequoia.config. If theses errors  return, you have to repeat all changes again.

So you can use the new solution above.

If you find a better alternative, show me in the comments below that they will be tested.

Happy New Year for all.

Building NVIDIA packages for Debian using kernel 6.0

Finally kernel 6.0 has been released ( https://lkml.iu.edu/hypermail/linux/kernel/2210.0/00685.html  ) and it time to update my machine for this kernel.

6.0: mainline Version: 6.0 (mainline) Released: 2022-10-02 Source: linux-6.0.tar.xz PGP Signature: linux-6.0.tar.sign Patch: full https://t.co/92ScQXt9Ou #linux #kernel

— Linux Kernel Releases (@LinuxKReleases) October 3, 2022

But first I have to check http://rglinuxtech.com/ if there is some catch. And I found one from NVIDIA:  http://rglinuxtech.com/?p=3060 .  There is a recent NVIDIA driver but, when I was writing this, the last version available from Debian experimental is: 510.85.02-2. And I need 515.76.

So there are only two options. Patch 510.85.02 or get their source code from https://salsa.debian.org/nvidia-team/nvidia-graphics-drivers . I choose forking it.

There are a few differences between 510 and 515 but, after some time, I finally build all packages needed to update my system.

If you are impatient and you cannot wait Debian to release this version or you don't like to use NVIDIA installer. You can get the sources from: https://github.com/adilsond/nvidia-graphics-drivers . Unfortunately I have only Ubuntu PPA's and there is no Debian equivalent. So you have to read the instructions for building all packages.

Have a nice week

Choqok 1.6 available for Kubuntu

Se não entendeu nada siga para a versão em Português em: http://www.adilson.net.br/2016/10/choqok-16-disponivel-para-kubuntu.html

After more than one year and half of depvelopment, finally they released Choqok 1.6. Choqok is a microblog client compatible with Twitter and other services. The official annoucement is at http://choqok.gnufolks.org/2016/10/choqok-1-6-released/ released last Sartuday.

With the release, now it's time to package this version since I made them available for some time. I had just stopped when they started to migrate the software from KDE 4 to KDE Frameworks 5. Must packages, which this new Choqok depends, was not available for Debian and Ubuntu. Which made it difficult to create the packages. And I was very busy with another personal tasks so I gave up building.

But, at this last weekend, I take courage and, with more time available, I started to view this version. It was necessary to review all dependencies. But one of them had to be recreated: qoauth.

This Choqok version requires qoauth 2.0.1, which is compatible wit QT5 and no packages for Debian or Ubuntu are available. I had created a package last year but it was failed to build at Launchpad. Now,at this weekend, I applied some fixes and the package was sucessufully built.

After this, I applied one more fixes and, finally, Choqok 1.6 is now available. The packages are available for Xenial and the future Yakkety versions of Ubuntu. I tried to build for Trusty but it breaks on this dependency. And I have no plans to backport libqca-qt5-2 for Trusty.

For those who use Debian I would like to make some packages available but I don't have a place to keep a repository. But the sources  are all compatible with sid and testing versions. The sources for Choqok and qoauth2 can be downloaded from the PPA and compiled on your machine.  Remember to compile qoauth2 first since Choqok depends on it for building the package.

To download the packages just access the PPA . For those who uses Xenial or Yakkety, you can add the repository with these commands:

sudo add-apt-repository ppa:adilson/experimental

sudo apt-get update

sudo apt-get install choqok

Doubts or bugs on the packages (The package does not install or the plugin is on the wrong place), just ask me on the blog or Twitter. If the problem is on the Software, the bug must be addressed to https://bugs.kde.org/component-report.cgi?product=choqok

Have a nice week.

The truth about CALA A BOCA GALVAO

This is my first post in English and there are lots of explanations about the top Trending Topic on Twitter: CALA A BOCA GALVAO.


One explanation:


GALVAO is a very rare bird in Brazil. CALA BOCA means SAVE, the brazilians are very sad because lots of GALVAOS die everyday.


Okey. Let see if this tweet is true, even with this ad talking about the rare bird aka Galvanus brasiliensis:

Or this youtube video shows exactly what I'm saying:







Another explanaition:


CALA BOCA GALVAO IT'S A NEW SONG BY LADY GAGA, IT'S AMAZING!


Check this link from youtube and there's no CALA BOCA GALVAO clip after Alejandro. 


http://www.youtube.com/LadyGagaVEVO

Even if you check this link: http://en.wikipedia.org/wiki/Lady_Gaga_discography
There is no CALA A BOCA GALVAO single and even if you try to edit, this article is protected.


Now another tweet from someone with a big doubt:


now its real confusing , some says CALA BOCA GALVAO means shut up galvao , some says save a bird , some says a song by lady gaga :o :s


We, Brazilians, like to make some jokes and the last two, the bird and single are only jokes :) The frist one is really true. Is about Galvão Bueno. This Wikipedia link shows some annoying tags that he repeats all time :) That's why we are saying SHUT UP GALVAO. And because of this World Cup, this Trending Topic will be on the top for a long time.

Here is the Galvão that we are talking about

Update (June 16): More about this joke from the New York Times:

http://goal.blogs.nytimes.com/2010/06/14/brazilian-soccer-fans-cant-stand-the-din/

Bom, este post é em inglês para nossos amigos estrangeiros que não entenderam nada até agora e, quando entrarem aqui, vão entender a verdade sobre toda esta piada global :P


Mais sobre essa brincadeira:


http://wp.clicrbs.com.br/admiravelmundovirtual/2010/06/11/o-dia-em-que-o-passaro-galvao-foi-salvo-pelo-mundo-por-meio-do-twitter/


http://oglobo.globo.com/pais/noblat/posts/2010/06/11/sucesso-mundial-cala-boca-galvao-299364.asp


http://odiario.com/geral/noticia/307925/cala-boca-galvao-se-mantem-como-assunto-mais-tuitado.html

Atualização: 14/06 - Já virou notícia na Espanha. Link para o El Pais:
http://www.elpais.com/articulo/tecnologia/Cala/boca/Galvao/elpeputec/20100614elpeputec_4/Tes