I notified security@google.com about this as well, and provided some further information there in an update email (which I hope is read...).

I just released APT 1.2.7 (should hopefully hit Ubuntu xenial tomorrow).

This now results in the following warnings:

W: gpgv:/var/lib/apt/lists/partial/dl.google.com_linux_chrome_deb_dists_stable_Release.gpg: The repository is insufficiently signed by key 4CCA1EAF950CEE4AB83976DCA040830F7FAC5991 (weak digest)
W: Failed to fetch http://dl.google.com/linux/chrome/deb/dists/stable/Release  No Hash entry in Release file /var/lib/apt/lists/partial/dl.google.com_linux_chrome_deb_dists_stable_Release, which is considered strong enough for security purposes

The first one is really only a warning, the second is actually an error followed by:
E: Some index files failed to download. They have been ignored, or old ones used instead.

Shortterm, all you need to do is add SHA256 fields to Release and Packages files with the correct values. This gets rid of the error; but keeps the warning. Longer term, the repository should also move away from the DSA signing key to a 2048-bit or stronger RSA keys and use SHA512 or SHA256 for the signature in the Release.gpg file.

phajdan.jr@: Can you help me route this to the right folks? Seems like something we ought to fix. :)

julian.klode@: Thanks for the report! Sorry it took us so long to see. When stuff like this pops up in the future, `security@chromium.org` will get to Chrome folks faster.

The next repository update should have the sha256 checksums.

Perfect. Thanks.

Don't forget to migrate the signing key from DSA with SHA1 to RSA with a SHA2 hash in the next months, so that we can turn of SHA1 for GPG signatures in APT for Ubuntu 16.10 (start shipping an RSA key, and sign the repository with both the old and the new key for some time, then you can drop the old DSA one at some point).

http://dl.google.com/linux/talkplugin/deb is also affected.