GnuPG uses SHA1 for key signatures

Sorry, there were two glitches in the original instructions:
- You need to generate the GPG home directory before ($ mkdir test), otherwise key generation will fail.

- The "$ gpg --edit-key name-of-first-key" should instead be "$ gpg --homedir test --local-user name-of-second-key -edit-key name-of-first-key". I.e. the home directory was not specified, and you need to tell GPG to use the *second key* for signing the first.

Damn, another typo in the previous comment ("-edit-key" instead of "--edit-key"). Sorry sorry. Here is everything fixed with reduced line count:
$ mkdir test
$ gpg --homedir test --gen-key
$ gpg --homedir test --gen-key
$ gpg --homedir test --local-user name-of-second-key --sign-key name-of-first-key
$ gpg --homedir test --export name-of-first-key | gpg --homedir test --list-packets

"As of 2012, the most efficient attack against SHA-1 is considered to be the one by Marc Stevens[32] with an estimated cost of $2.77M to break a single hash value by renting CPU power from cloud servers.[33] Stevens developed this attack in a project called HashClash,[34] implementing a differential path attack. On 8 November 2010, he claimed he had a fully working near-collision attack against full SHA-1 working with an estimated complexity equivalent to 2^57.5 SHA-1 compressions. He estimates this attack can be extended to a full collision with a complexity around 2^61."

Source: http://en.wikipedia.org/w/index.php?title=SHA-1&oldid=598619464#Attacks

Thanks for opening this bug.

Please report this issue in the upstream bug tracker:

https://bugs.g10code.com/gnupg/index

Once you've done that, link the upstream bug here. Thanks.