We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
determine post-upgrade failure-mode for a SHA-1-signed submission key
## Description

After #6948 (for #6399), redwood will refuse to encrypt to a submission key with a SHA-1 signature.

After #6928, `securedrop-admin sdconfig` will reject a submission key with a SHA-1 signature.  This check guarantees that new and reconfigured instances will comply with #6948.

What will happen to an instance with a SHA-1-signed signature after upgrading to v2.7.0?

## Possible approaches

| Option | Documentation changes | Code changes | Implication |
| --- | --- | --- | --- |
| Fail open, but log | optional | ✓ | Admin must monitor logs and/or OSSEC alerts. |
| Fail open, but document | ✓ | ✗ | Admin must monitor release notes or check documentation. |
| Fail closed | optional | ✓[1] | Admin can contact us for help. |

**Notes:**
1. @legoktm observes that, without a code change to handle this case, Apache will come back up after reboot even if the `postinst` script fails under `unattended-upgrades`.

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `securedrop/journalist.py`
Content:
```
1 from encryption import EncryptionManager, GpgKeyNotFoundError
2 from execution import asynchronous
3 from journalist_app import create_app
4 from models import Source
5 from sdconfig import SecureDropConfig
6 
7 config = SecureDropConfig.get_current()
8 # app is imported by journalist.wsgi
9 app = create_app(config)
10 
11 
12 @asynchronous
13 def prime_keycache() -> None:
14     """Pre-load the source public keys into Redis."""
15     with app.app_context():
16         encryption_mgr = EncryptionManager.get_default()
17         for source in Source.query.filter_by(pending=False, deleted_at=None).all():
18             try:
19                 encryption_mgr.get_source_public_key(source.filesystem_id)
20             except GpgKeyNotFoundError:
21                 pass
22 
23 
24 prime_keycache()
25 
26 
27 if __name__ == "__main__":  # pragma: no cover
28     debug = getattr(config, "env", "prod") != "prod"
29     # nosemgrep: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
30     app.run(debug=debug, host="0.0.0.0", port=8081)
31
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/securedrop/journalist.py b/securedrop/journalist.py
--- a/securedrop/journalist.py
+++ b/securedrop/journalist.py
@@ -1,9 +1,13 @@
+import sys
+
 from encryption import EncryptionManager, GpgKeyNotFoundError
 from execution import asynchronous
 from journalist_app import create_app
 from models import Source
 from sdconfig import SecureDropConfig
 
+import redwood
+
 config = SecureDropConfig.get_current()
 # app is imported by journalist.wsgi
 app = create_app(config)
@@ -21,10 +25,28 @@
                 pass
 
 
-prime_keycache()
+def validate_journalist_key() -> None:
+    """Verify the journalist PGP key is valid"""
+    encryption_mgr = EncryptionManager.get_default()
+    # First check that we can read it
+    try:
+        journalist_key = encryption_mgr.get_journalist_public_key()
+    except Exception as e:
+        print(f"ERROR: Unable to read journalist public key: {e}", file=sys.stderr)
+        app.logger.error(f"ERROR: Unable to read journalist public key: {e}")
+        sys.exit(1)
+    # And then what we read is valid
+    try:
+        redwood.is_valid_public_key(journalist_key)
+    except redwood.RedwoodError as e:
+        print(f"ERROR: Journalist public key is not valid: {e}", file=sys.stderr)
+        app.logger.error(f"ERROR: Journalist public key is not valid: {e}")
+        sys.exit(1)
 
 
 if __name__ == "__main__":  # pragma: no cover
+    validate_journalist_key()
+    prime_keycache()
     debug = getattr(config, "env", "prod") != "prod"
     # nosemgrep: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host
     app.run(debug=debug, host="0.0.0.0", port=8081)

{"golden_diff": "diff --git a/securedrop/journalist.py b/securedrop/journalist.py\n--- a/securedrop/journalist.py\n+++ b/securedrop/journalist.py\n@@ -1,9 +1,13 @@\n+import sys\n+\n from encryption import EncryptionManager, GpgKeyNotFoundError\n from execution import asynchronous\n from journalist_app import create_app\n from models import Source\n from sdconfig import SecureDropConfig\n \n+import redwood\n+\n config = SecureDropConfig.get_current()\n # app is imported by journalist.wsgi\n app = create_app(config)\n@@ -21,10 +25,28 @@\n                 pass\n \n \n-prime_keycache()\n+def validate_journalist_key() -> None:\n+    \"\"\"Verify the journalist PGP key is valid\"\"\"\n+    encryption_mgr = EncryptionManager.get_default()\n+    # First check that we can read it\n+    try:\n+        journalist_key = encryption_mgr.get_journalist_public_key()\n+    except Exception as e:\n+        print(f\"ERROR: Unable to read journalist public key: {e}\", file=sys.stderr)\n+        app.logger.error(f\"ERROR: Unable to read journalist public key: {e}\")\n+        sys.exit(1)\n+    # And then what we read is valid\n+    try:\n+        redwood.is_valid_public_key(journalist_key)\n+    except redwood.RedwoodError as e:\n+        print(f\"ERROR: Journalist public key is not valid: {e}\", file=sys.stderr)\n+        app.logger.error(f\"ERROR: Journalist public key is not valid: {e}\")\n+        sys.exit(1)\n \n \n if __name__ == \"__main__\":  # pragma: no cover\n+    validate_journalist_key()\n+    prime_keycache()\n     debug = getattr(config, \"env\", \"prod\") != \"prod\"\n     # nosemgrep: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host\n     app.run(debug=debug, host=\"0.0.0.0\", port=8081)\n", "issue": "determine post-upgrade failure-mode for a SHA-1-signed submission key\n## Description\r\n\r\nAfter #6948 (for #6399), redwood will refuse to encrypt to a submission key with a SHA-1 signature.\r\n\r\nAfter #6928, `securedrop-admin sdconfig` will reject a submission key with a SHA-1 signature.  This check guarantees that new and reconfigured instances will comply with #6948.\r\n\r\nWhat will happen to an instance with a SHA-1-signed signature after upgrading to v2.7.0?\r\n\r\n## Possible approaches\r\n\r\n| Option | Documentation changes | Code changes | Implication |\r\n| --- | --- | --- | --- |\r\n| Fail open, but log | optional | \u2713 | Admin must monitor logs and/or OSSEC alerts. |\r\n| Fail open, but document | \u2713 | \u2717 | Admin must monitor release notes or check documentation. |\r\n| Fail closed | optional | \u2713[1] | Admin can contact us for help. |\r\n\r\n**Notes:**\r\n1. @legoktm observes that, without a code change to handle this case, Apache will come back up after reboot even if the `postinst` script fails under `unattended-upgrades`.\n", "before_files": [{"content": "from encryption import EncryptionManager, GpgKeyNotFoundError\nfrom execution import asynchronous\nfrom journalist_app import create_app\nfrom models import Source\nfrom sdconfig import SecureDropConfig\n\nconfig = SecureDropConfig.get_current()\n# app is imported by journalist.wsgi\napp = create_app(config)\n\n\n@asynchronous\ndef prime_keycache() -> None:\n    \"\"\"Pre-load the source public keys into Redis.\"\"\"\n    with app.app_context():\n        encryption_mgr = EncryptionManager.get_default()\n        for source in Source.query.filter_by(pending=False, deleted_at=None).all():\n            try:\n                encryption_mgr.get_source_public_key(source.filesystem_id)\n            except GpgKeyNotFoundError:\n                pass\n\n\nprime_keycache()\n\n\nif __name__ == \"__main__\":  # pragma: no cover\n    debug = getattr(config, \"env\", \"prod\") != \"prod\"\n    # nosemgrep: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host\n    app.run(debug=debug, host=\"0.0.0.0\", port=8081)\n", "path": "securedrop/journalist.py"}], "after_files": [{"content": "import sys\n\nfrom encryption import EncryptionManager, GpgKeyNotFoundError\nfrom execution import asynchronous\nfrom journalist_app import create_app\nfrom models import Source\nfrom sdconfig import SecureDropConfig\n\nimport redwood\n\nconfig = SecureDropConfig.get_current()\n# app is imported by journalist.wsgi\napp = create_app(config)\n\n\n@asynchronous\ndef prime_keycache() -> None:\n    \"\"\"Pre-load the source public keys into Redis.\"\"\"\n    with app.app_context():\n        encryption_mgr = EncryptionManager.get_default()\n        for source in Source.query.filter_by(pending=False, deleted_at=None).all():\n            try:\n                encryption_mgr.get_source_public_key(source.filesystem_id)\n            except GpgKeyNotFoundError:\n                pass\n\n\ndef validate_journalist_key() -> None:\n    \"\"\"Verify the journalist PGP key is valid\"\"\"\n    encryption_mgr = EncryptionManager.get_default()\n    # First check that we can read it\n    try:\n        journalist_key = encryption_mgr.get_journalist_public_key()\n    except Exception as e:\n        print(f\"ERROR: Unable to read journalist public key: {e}\", file=sys.stderr)\n        app.logger.error(f\"ERROR: Unable to read journalist public key: {e}\")\n        sys.exit(1)\n    # And then what we read is valid\n    try:\n        redwood.is_valid_public_key(journalist_key)\n    except redwood.RedwoodError as e:\n        print(f\"ERROR: Journalist public key is not valid: {e}\", file=sys.stderr)\n        app.logger.error(f\"ERROR: Journalist public key is not valid: {e}\")\n        sys.exit(1)\n\n\nif __name__ == \"__main__\":  # pragma: no cover\n    validate_journalist_key()\n    prime_keycache()\n    debug = getattr(config, \"env\", \"prod\") != \"prod\"\n    # nosemgrep: python.flask.security.audit.app-run-param-config.avoid_app_run_with_bad_host\n    app.run(debug=debug, host=\"0.0.0.0\", port=8081)\n", "path": "securedrop/journalist.py"}]}