Github sha-1 error's from 11th of Jan.

Nils_fdzvgu

Hello,

running an old version of bamboo server 5.14.5. Today Github stopped allowing SHA-1.

 

Logs are now full of bellow error and can not build.

ERROR: You're using an RSA key with SHA-1, which is no longer allowed. Please use a newer client or a different key type.

and catalina.out contain.

2022-01-11 16:07:53,744 WARN [sshd-SshClient[7c628a8b]-nio2-thread-4] [BambooTrustedKeyServerKeyVerifier] Server at github.com/140.82.121.4:22 presented unverified EC key: SHA256:...............

We are assuming this is because of some old java lib, which version do we need to upgrade to? Does 8.x versions also have these problems ?

Joe Radkowski

We are also facing this issue and would appreciate a response on this issue too, but here is what I have found.

 

GitHub Security Bulletin: https://github.blog/2021-09-01-improving-git-protocol-security-github/#when-are-these-changes-effective

GitHub is conducting a test where they disable old keys for RSA/DSA (SHA1) to get people aware they need to update their key before March 15th where it will be blocked for good. 

What is interesting is our key is SHA2! The key works from the command line, but within Bamboo it fails with the error message above.

I hope to hear 7.x or 8.x fixes this because we are long overdue for an upgrade (we are on 6.8.x) and will get that process moving once we have confirmation on what version to upgrade to.