-
Type:
Improvement
-
Resolution: Unresolved
-
Priority:
Normal
-
None
-
Affects Version/s: None
-
Component/s: Database setup
-
None
Hi there. The keys used for signing the Musicbrainz data dumps (D5E6 3B4B DCCE 1956 4294 8684 B8FC 2375 C777 580F, it seems?) are quite old (2012-09-18) and uses cryptography now considered insecure.
Could the keys possibly be rotated? I'm trying to write a tool that consumes the dumps, but the implementations of OpenPGP I've tried all have issues verifying authenticity due to the use of SHA-1.
Sequoia inspect output
$ gpg --export D5E63B4BDCCE195642948684B8FC2375C777580F | sq inspect -: OpenPGP Certificate. Fingerprint: D5E63B4BDCCE195642948684B8FC2375C777580F Invalid: No binding signature at time 2026-03-28T20:07:15Z: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance, because SHA1 is not considered secure since 2023-02-01T00:00:00Z Public-key algo: RSA Public-key size: 2048 bits Creation time: 2012-09-18 17:38:38 UTC Subkey: 3CA330EE23B47A79AB76FA3619AF6A3243513089 Invalid: Policy rejected non-revocation signature (SubkeyBinding) requiring second pre-image resistance because: SHA1 is not considered secure since 2023-02-01T00:00:00Z Invalid: primary key: No binding signature at time 2026-03-28T20:07:15Z, because Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance, because SHA1 is not considered secure since 2023-02-01T00:00:00Z Public-key algo: RSA Public-key size: 2048 bits Creation time: 2012-09-18 17:38:38 UTC UserID: MusicBrainz (MusicBrainz data dump signing key) <support@musicbrainz.org> Invalid: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2023-02-01T00:00:00Z