Werk #15693: Disable SHA1 signatures for agents

Component

Agent bakery

Title

Disable SHA1 signatures for agents

Date

Aug 4, 2023

Level

Trivial Change

Class

New Feature

Compatibility

Incompatible - Manual interaction might be required

Checkmk versions & editions

2.3.0b1 Not yet released	Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)
2.3.0b1	Checkmk Enterprise (CEE), Checkmk Cloud (CCE), Checkmk MSP (CME)

tl,dr; Update agents to 2.2.0b8 or later before updating the site to 2.3.0!

With this Werk Checkmk will no longer generate and validate SHA1 signatures for agent packages. With Werk #15692 Checkmk generated SHA256 signatures and the agent-updater is capable to verify SHA256 signatures since 2.2.0b8.

If you have agent updaters older than 2.2.0b8 these will not be able to verify agent packages anymore and therefore need manual updating after this Werk. We recommend to install at least 2.2.0p8 and update all agents before updating to 2.3.0.

If you were on 2.2.0p8 or beyond and all agents are up-to-date then no intervention will be necessary.

To the list of all Werks