manifests: fedora-coreos-base: remove temporary support for RSA-SHA1 keys on F33

[dustymabe]

We added this in be947c2 because we needed to still be able to run kola
tests on AWS. Now we have a new workaround in COSA [1] so we don't need
to downgrade the policy for SSH in the image.

[1] coreos/coreos-assembler#1797

[dustymabe]

I opened this against next-devel for now. Will rebase onto testing-devel once the tests pass (which will need coreos/coreos-assembler#1797 before they will pass).

[cgwalters]

Maybe I'm missing something here but...isn't this more fundamentally that the crypto policy change is probably going to break a lot of Fedora users in general on AWS?

[bgilbert]

Maybe I'm missing something here but...isn't this more fundamentally that the crypto policy change is probably going to break a lot of Fedora users in general on AWS?

No. RSA keys are still valid, but the RSA authentication handshake now requires a different hash algorithm. So the problem only affects old client implementations (the Go SSH client, the Ruby SSH for Vagrant, etc.) that don't support the new algos.

[cgwalters]

Right, I understand. I guess the debate here comes down to the values of "a lot".

[cgwalters]

The relationship with AWS is that on other clouds ecdsa or hopefully also ed25519 keys are valid which sidesteps the problem. Although have we done that analysis on a per-cloud basis?

In a quick spot check it looks like GCP supports all those key types.

[cgwalters]

https://forums.aws.amazon.com/thread.jspa?threadID=250753

[dustymabe]

coreos/coreos-assembler#1797 was obsoleted by coreos/coreos-assembler#1799 (which merged). Kicking off a CI run here.

[dustymabe]

CI passed. Rebasing on testing-devel now and if CI passes will merge.

[dustymabe]

hmm and it looks like CI gets in a weird state if you switch the target branch. Since CI already passed once I'm going to merge this and deal with the consequences (hopefully none) later.