Weak digst algorithm (Debian APT install)

The procedure, you refer to at the page
https://docs.mycroft.ai/development/getting.started
leads into problems, when used with Ubuntu 16.04
This works without problems:
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys F3B1AA8B

But when I try to
sudo apt-get update
I get the following error:
W: http://repo.mycroft.ai/repos/apt/debian/dists/debian/InRelease: Signature by key 270270023CF62637D56D51F7AD155859F3B1AA8B uses weak digest algorithm (SHA1)

and i can NOT
sudo apt-get install mycroft-core
it leads into a
E: Paket mycroft-core kann nicht gefunden werden.
(which should be ‘mycroft-core can’t be found’ in English (I’m on a german System))

1 Like

Hello,

I’m not sure what you second issue is, you might try updating your cache again.

Sha 1 problem is one that I’ve been working to solve. From everything I’ve read, reprepro is supposed to sign the package and not the builder. I’ve tried many times, used a master and sub key, both with 4096 bit sha512, but I get the same results. I’ve been told several times that Ubuntu will continue to complain unless we use a PPA from launchpad. Other versions of Debian don’t give me errors, and I’ve added many an outside repo from other organizations and have the exact issue with them as well… If you have any suggestions, I am very open to them.

Our build system is somewhat difficult, and I’ve been working on different ways to submit a source package to launchpad. This issue should be resolved soon with an official PPA. There is a lot of linting to do, striping of binaries, proper control files for release and development tracks, etc.

I’m sorry that you can’t get it to install this way. I would very much recommend using the git checkout method instead for the time being.

Thank you.

Arron

2 Likes

Thank you very much for your prompt reply, Arron,

the second issue seems the result of the first one, it seems, that Ubuntu refuses to accept/download the repository (and the file table, what there is included), because of the weak password. And therefore there is no entry for any ‘mycroft-core’.

I’ve tried to download the ZIP and install mycroft - and ran into other problems: I seem to attract them :wink: but I won’t boter you with that before doing my best to resolve them on my own.

It seems, that I have to learn how to use the git checkout method.

Hi I also ran into this problem with Xubuntu 16.04 here is the errors I get:

W: http://repo.mycroft.ai/repos/apt/debian/dists/debian/InRelease: Signature by key 270270023CF62637D56D51F7AD155859F3B1AA8B uses weak digest algorithm (SHA1)

I added the > deb http://repo.mycroft.ai/repos/apt/debian debian main"
in the software & updates under other software since the
Create apt source entry (stable releases).

sudo echo “deb http://repo.mycroft.ai/repos/apt/debian debian main” > /etc/apt/sources.list.d/repo.mycroft.ai.list

did not add it to source file
then ran into another problem when running

sudo apt-get install mycroft-core

Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 mycroft-core : Depends: portaudio19-dev but it is not going to be installed
E: Unable to correct problems, you have held broken packages.

Hope this helps

I was able to finally get things to install by walking up the failure tree…

Keep in mind that my install is a 14.04 host, but I suspect the failures in the packages can be resolved identically. I had the same problem as you did in the beginning.

The following packages have unmet dependencies:
mycroft-core : Depends: portaudio19-dev but it is not going to be installed
begat:
The following packages have unmet dependencies:
portaudio19-dev : Depends: libjack-dev
begat:
The following packages have unmet dependencies:
libjack-dev : Depends: libjack0 (= 1:0.121.3+20120418git75e3e20b-2.1ubuntu1) but it is not going to be installed

Going backwards fixed the issue for me:
sudo apt-get install libjack0
sudo apt-get install libjack-dev
sudo apt-get install portaudio19-dev
and then finally:
sudo apt-get install mycroft-core

Yes, I know you can make it install them all at once, but I like to verify one at a time so there are no surprises where a problem is happening.

Hope this helps someone else having these troubles get them fixed quickly.

My guess would be that aptitude might be able to fix all the dependency issues for anyone else who has the same problem. So I would recommend trying sudo aptitude install mycroft-core if apt-get doesn’t work.