[build] Sign debs with sha512

[jbudz]

Debian/ubuntu will be disabling support for release files signed with sha1 in the future, and currently a warning is shown. This makes sure the release file is signed using sha512. Closes #7992.

See https://wiki.debian.org/Teams/Apt/Sha1Removal

[jbudz]

jenkins, test this

[epixa]

LGTM

[thomasneirynck]

LGTM

[cwhsu1984]

Hi,

my os is ubuntu 16.04
Is this issue fixed?

W: http://packages.elastic.co/kibana/4.5/debian/dists/stable/Release.gpg: Signature by key 46095ACC8548582C1A2699A9D27D666CD88E42B4 uses weak digest algorithm (SHA1)
W: GPG error: http://ppa.launchpad.net/webupd8team/java/ubuntu xenial InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY C2518248EEA14886
W: The repository 'http://ppa.launchpad.net/webupd8team/java/ubuntu xenial InRelease' is not signed.
N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use.
N: See apt-secure(8) manpage for repository creation and user configuration details.

[epixa]

@cwhsu1984 This issue is fixed in 5.0.0 GA, but you need to remove the 5.x-prerelease repo and replace it with the 5.x repo in order to get GA instead of RC1.

Delete or empty /etc/apt/sources.list.d/kibana.list, then follow the instructions on https://www.elastic.co/guide/en/kibana/current/deb.html#deb-repo