self-signatures using SHA1

Question

This page says:

self-signatures must not use SHA1

You can check this by doing:

gpg --export-options export-minimal --export <keyid> | gpg --list-packets |grep -A 2 signature|grep 'digest algo 2,'

If you see any ‘digest algo 2’ results printed, then you have some self-signatures that are using SHA1, as digest algo 2 is SHA1. See the OpenPGP RFC 4880, section 9.4 for a table that maps hash algorithms to numbers.

I set up a key following best practice instructions (Debian's developer keysigning guidelines), but I get digest algo 2 lines printed when I run this. What exactly does this mean, and what part of setting up the key affects this?

Answer 1

This does mean some part is signed using SHA1 as hashing algorithm. If you view the full output of gpg --export-options export-minimal --export <keyid> | gpg --list-packets, you may find which part.