Bug 480017

The SHA-1 hash has known weaknesses, we should migrate to a SHA-2 digest algorithm.  See https://fedoraproject.org/wiki/Features/StrongerHashes for more rationale and information.

SHA-1 is currently used in the SHA1SUM files used to authenticate the release, both for hashes of the signed files and for the hash used inside the GPG signature.

It is not necessary to rename the file each time each time a new hash is used because the coreutils *sum utilities ignore incorrectly formatted lines.  We can therefore create a signed ISO-SUMS file that starts with the following text
(or add the text to installation guide?):
   This file is digitally signed: if you have the Fedora N key in your keyring,
   verify the authenticity of the file using (gpg --verify ISO-SUMS).

   If you have downloaded ISO images to the same directory as this file, verify
   them using the first command from the following list available on your
   system:

   [commands newer hash types would go here in the future]
   $ sha256sum -c ISO-SUMS
   $ sha1sum -c ISO-SUMS

   The cryptographic hashes follow.

   [output of newer *sum programs would go here in the future]
   [sha256sum output]
   [sha1sum output]
(This also allows running (sha1sum ISO-SUMS) from a script for all releases that use ISO-SUMS, even if newer hashes are available; that doesn't help security any, but it makes script writing a bit more convenient.)

In addition to using sha256sum to compute published hashes, the digital signature needs to use SHA-256: generate it using (gpg --digest-algo sha256 ...).  To make sure the public key signature is at least comparably strong to the hash, the public key used to sign the file should be at least 2048 bits long.  RPM currently supports only RSA keys for signatures embedded in packages (see #479859) - so the Fedora 11 release key should be a RSA key with key size at least 2048 bits.