GPG signatures are using SHA-1 digests

[glandium]

$ curl -sL https://static.rust-lang.org/dist/rustc-nightly-src.tar.gz.asc | gpg --list-packets
# off=0 ctb=89 tag=2 hlen=3 plen=540
:signature packet: algo 1, keyid 5CB4A9347B3B09DC
	version 4, created 1505866125, md5len 0, sigclass 0x00
	digest algo 2, begin of digest 3e 44
	hashed subpkt 2 len 4 (sig created 2017-09-20)
	subpkt 16 len 8 (issuer key ID 5CB4A9347B3B09DC)
	data: [4096 bits]

The relevant information there is "digest algo".
1 is MD5, 2 is SHA1, 8 is SHA256, 10 is SHA512. (see RFC 4880, 9.4 for all values)

Passing e.g. --personal-digest-preferences SHA256 to gpg would create a signature with digest algo 8. (or adding personal-digest-preferences SHA256 to the gpg config)

[est31]

Just verified it, its fixed now:

$ curl -sL https://static.rust-lang.org/dist/rustc-nightly-src.tar.gz.asc | gpg --list-packets
# off=0 ctb=89 tag=2 hlen=3 plen=540
:signature packet: algo 1, keyid 5CB4A9347B3B09DC
        version 4, created 1506211716, md5len 0, sigclass 0x00
        digest algo 10, begin of digest 1d dd
        hashed subpkt 2 len 4 (sig created 2017-09-24)
        subpkt 16 len 8 (issuer key ID 5CB4A9347B3B09DC)
        data: [4096 bits]