[Lynx-dev] gpg cross signatures using SHA-1

[Andreas Metzler]

Good Morning,

gpg does not like the cross-signatures of the old keys
0AFD1FFEEA2EA063B959ACDA5DDF8FB7688E31A6 and
C52048C0C0748FEE227D47A2702353E0F7E48EDB on the new rsa4096 key
B61F9B925CBC2D32F337A11E40E374BE21A15E49:

ametzler@argenau:/tmp/LYNX$ gpg --homedir  /tmp/GPGHOME --check-sigs 
B61F9B925CBC2D32F337A11E40E374BE21A15E49
pub   rsa4096 2021-07-04 [SCE]
      B61F9B925CBC2D32F337A11E40E374BE21A15E49
uid           [ unknown] Thomas E. Dickey <dickey@invisible-island.net>
sig!3        40E374BE21A15E49 2021-07-04  Thomas E. Dickey 
<dickey@invisible-island.net>
gpg: Note: third-party key signatures using the SHA1 algorithm are rejected
sig%         702353E0F7E48EDB 2021-07-04  [Invalid digest algorithm]
sig%         5DDF8FB7688E31A6 2021-07-04  [Invalid digest algorithm]

gpg: 1 good signature
gpg: 2 signatures not checked due to errors

cu Andreas
-- 
`What a good friend you are to him, Dr. Maturin. His other friends are
so grateful to you.'
`I sew his ears on from time to time, sure'