Bug 479863

+++ This bug was initially created as a clone of Bug #479859 +++

RPMs are currently signed using a DSA key and a SHA-1 message digest.  SHA-1 has known weaknesses, we should migrate to signatures that use a SHA-2 hash.

See https://fedoraproject.org/wiki/Features/StrongerHashes for more detailed rationale.

RPM currently supports SHA-2 only with RSA keys.  The key size should be at least 2048 bits, which [1] claims achieves algorithm strength of 112 bits (with SHA-256 strength of 128 bits, the result is the smaller value, i.e. 112 bits).

So, the RHEL6 key should be a RSA key with key size at least 2048 bits.  (This means the key needs to be different from the key used to sign RHEL 5!)

To use SHA-256 with the key, define the following macro:
--define '__gpg_sign_cmd %{__gpg} gpg --force-v3-sigs --digest-algo sha256 --batch --no-verbose --no-armor --passphrase-fd 3 --no-secmem-warning -u "%{_gpg_name}" -sbo %{__signature_filename} %{__plaintext_filename}'

(--force-v3 sigs is necessary due to #436812).

This creates RPMs that can be handled by rpm at least since RHEL5 (rpm-4.4.2), but not by the RHEL4 rpm (4.3.3).

[1] http://csrc.nist.gov/publications/nistpubs/800-57/sp800-57-Part1-revised2_Mar08-2007.pdf