RFE: always use SHA256 digests in Release file signatures

[ktdreyer]

Apt on Ubuntu Xenial (and newer) will warn if the Apt repo GPG signatures are SHA1 instead of SHA256.

Background links:

• https://gitlab.com/gitlab-com/operations/issues/344
• http://www.spinics.net/lists/ceph-users/msg28157.html

By default, gnupg2 has a sha1 digest algorithm.

As a workaround, a long time ago I added "digest-algo sha256" to the gpg.conf file on the local signer system, like so:

# See http://askubuntu.com/questions/819641/reprepro-signature-by-key-uses-weak-digest-algorithm-sha1
# and https://juliank.wordpress.com/2016/03/14/dropping-sha-1-support-in-apt/
digest-algo sha256

It would be more robust if merfi ran gpg2 with the --digest-algo SHA256 argument every time, so we did not depend on the state of the local .gpg.conf file.

[ktdreyer]

This might be resolved in the very latest GnuPG 2. It seems like Fedora 29 signs with SHA256 by default.