# SCM-Manager installation problem: sha-1 not supported

**URL:** <https://community.cloudogu.com/t/scm-manager-installation-problem-sha-1-not-supported/1520>\
**Category:** SCM-Manager (General)\
**Created:** [July 27, 2025, 3:40pm UTC](https://community.cloudogu.com/t/scm-manager-installation-problem-sha-1-not-supported/1520 "2025-07-27T15:40:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kryszard](https://dub1.discourse-cdn.com/flex013/user_avatar/community.cloudogu.com/kryszard/32/1681_2.png) [@kryszard](https://community.cloudogu.com/u/kryszard)\
**Post date:** [July 27, 2025, 3:40pm UTC](https://community.cloudogu.com/t/scm-manager-installation-problem-sha-1-not-supported/1520/1 "2025-07-27T15:40:19Z")

</div>

I was trying to install `scm-manager` on Rocky Linux 9.6 and yum ended with this error:

```auto
warning: Signature not supported. Hash algorithm SHA1 not available.
...
Problem opening package scm-server-3.8.0.noarch.rpm.
...
Error: GPG check FAILED

```

[this page](https://www.redhat.com/en/blog/rhel-security-sha-1-package-signatures-distrusted-rhel-9), related to RHEL 9, explains why sha-1 is deprecated and provides workaround e.g. skipping gpg check via `dnf --nogpgcheck` .

UPDATE: the `--nogpgcheck` is not enough, now the error is:

```auto
Error: Transaction test error:
  package scm-server-0:3.8.0-.noarch does not verify: Header V4 RSA/SHA1 Signature, key ID 77d51fa4: BAD

```

Fortunately I could loosen the policy with `update-crypto-policies --set DEFAULT:SHA1`.

---

<div class="post-metadata">

**Author:** ![fscholdei](https://dub1.discourse-cdn.com/flex013/user_avatar/community.cloudogu.com/fscholdei/32/15_2.png) [@fscholdei](https://community.cloudogu.com/u/fscholdei)\
**Post date:** [July 29, 2025, 6:33am UTC](https://community.cloudogu.com/t/scm-manager-installation-problem-sha-1-not-supported/1520/2 "2025-07-29T06:33:17Z")

</div>

Hey kryszard,

Thanks for the report! We’re looking into it and will get back to you soon.