[fedora-badges] #353: Badge for using at least SHA-256 for signatures for GPG key in FAS

[fedora-badges]

#353: Badge for using at least SHA-256 for signatures for GPG key in FAS
-------------------------------------+-------------------------------------
                         Reporter:   |                    Owner:
  till                               |                   Status:  new
                             Type:   |                 Keywords:
  New badge idea                     |        Has a description:  0
                         Priority:   |           Artwork status:  None
  minor                              |    External requirements:
                       Has a name:   |  Triaged (triagers only):  0
  0                                  |
Concept approved (reviewers only):   |
  0                                  |
          Badge definition status:   |
  None                               |
                 Manually awarded:   |
  0                                  |
-------------------------------------+-------------------------------------
 What the badge should be granted for: For using at least SHA-256 for self
 signatures for ones own key
 Badge description (like "You added a co-maintainer to a package. BFF!"):
 You have a strong signature
 Anything else we need to know:
 as proposed in ticket:352, this can belong to a series of GPG key related
 badges

Some information about SHA1 signatures:
 https://www.debian-administration.org/users/dkg/weblog/48

[fedora-badges]

#353: Badge for using at least SHA-256 for signatures for GPG key in FAS
-------------------------------------+-------------------------------------
               Reporter:  till       |                              Owner:
                   Type:  New badge  |                             Status:
  idea                               |  new
               Priority:  minor      |                         Resolution:
               Keywords:             |                         Has a name:
      Has a description:  0          |  0
         Artwork status:  None       |  Concept approved (reviewers only):
  External requirements:             |  0
Triaged (triagers only):  0          |            Badge definition status:
                                     |  None
                                     |                   Manually awarded:
                                     |  0
-------------------------------------+-------------------------------------

Comment (by fale):

Hello,

How do we handle if more than one self sign is applied? We get the
 highest?
 How do we handle if multiple uid/subkeys with different SHA? We take the
 weakest?

[fedora-badges]

#353: Badge for using at least SHA-256 for signatures for GPG key in FAS
-------------------------------------+-------------------------------------
               Reporter:  till       |                              Owner:
                   Type:  New badge  |                             Status:
  idea                               |  new
               Priority:  minor      |                         Resolution:
               Keywords:             |                         Has a name:
      Has a description:  0          |  0
         Artwork status:  None       |  Concept approved (reviewers only):
  External requirements:             |  0
Triaged (triagers only):  0          |            Badge definition status:
                                     |  None
                                     |                   Manually awarded:
                                     |  0
-------------------------------------+-------------------------------------

Comment (by till):

Yes.