Cannot build on Debian 13 due to repository signed using SHA1

[RedVyper]

Summary

The sources cannot be built following the official guide due to the usage of a key that's signed using a SHA1 hash with the following error message:

Err:4 https://apt.llvm.org/trixie llvm-toolchain-trixie-20 InRelease   
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 6084F3CF814B57C1CF12EFD515CF4D18AF4F7421 is not bound:
No binding signature at time 2025-08-09T21:49:56Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

Operating system

Linux

Steps to reproduce

1.Spin a Debian Trixie container.
2. Install all the needed software via APT sudo apt install autoconf autoconf-archive automake build-essential ccache cmake curl fonts-liberation2 git libdrm-dev libgl1-mesa-dev libtool nasm ninja-build pkg-config python3-venv qt6-base-dev qt6-tools-dev-tools qt6-wayland tar unzip zip
3. Actually install also lsb-release package because the container doesn't have it and future commands will break.
4. Add the key. wget -O - https://apt.kitware.com/keys/kitware-archive-latest.asc 2>/dev/null | gpg --dearmor - | sudo tee /usr/share/keyrings/kitware-archive-keyring.gpg >/dev/null
5. Run sudo apt update -y and trigger the issue.

Expected behavior

The command apt update should just refresh the cache of the repositories without errors.

Actual behavior

This is the output:

Hit:1 http://deb.debian.org/debian trixie InRelease
Hit:2 http://deb.debian.org/debian trixie-updates InRelease                 
Hit:3 http://deb.debian.org/debian-security trixie-security InRelease       
Get:4 https://apt.llvm.org/trixie llvm-toolchain-trixie-20 InRelease [6834 B]
Err:4 https://apt.llvm.org/trixie llvm-toolchain-trixie-20 InRelease        
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 6084F3CF814B57C1CF12EFD515CF4D18AF4F7421 is not bound:            No binding signature at time 2025-08-09T21:49:56Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Ign:5 https://apt.kitware.com/ubuntu trixie InRelease
Err:6 https://apt.kitware.com/ubuntu trixie Release
  404  Not Found [IP: 66.194.253.25 443]
Warning: OpenPGP signature verification failed: https://apt.llvm.org/trixie llvm-toolchain-trixie-20 InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 6084F3CF814B57C1CF12EFD515CF4D18AF4F7421 is not bound:            No binding signature at time 2025-08-09T21:49:56Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Error: The repository 'https://apt.llvm.org/trixie llvm-toolchain-trixie-20 InRelease' is not signed.
Notice: Updating from such a repository can't be done securely, and is therefore disabled by default.
Notice: See apt-secure(8) manpage for repository creation and user configuration details.
Error: The repository 'https://apt.kitware.com/ubuntu trixie Release' does not have a Release file.
Notice: Updating from such a repository can't be done securely, and is therefore disabled by default.
Notice: See apt-secure(8) manpage for repository creation and user configuration details.

URL for a reduced test case

N/A

HTML/SVG/etc. source for a reduced test case

N/A

Log output and (if possible) backtrace

N/A

Screenshots or screen recordings

Not needed.

Build flags or config settings

Standard Debian Trixie container.

Contribute a patch?

• I’ll contribute a patch for this myself.

[Hendiadyoin1]

This seems to be an issue with the clang PPA, if you only very recently added it, you might want to raise an issue with them instead,

If you set it up a bit further back in time, not sure since when Debian has higher hash standards, you might want to remove and re-add the PPA and keys, to check if they already fixed it on their side

[Hendiadyoin1]

Wait on a second look you mention the kitware - so cmake - key in your setup, not the llvm PPA, which is shown in the errors?

Edit:
Oh kitware 404s for some reason...

[RedVyper]

I literally tested it while I was filling the issue form so it's as fresh as it can get.

Since I usually don't even trust myself I tried it back again.

New Debian Trixie container.
Install all the packages like in the guide. Actually before that update the repositories (there is no such thing in the guide, but, hey, that's not a newbie's task, right?)
apt install autoconf autoconf-archive automake build-essential ccache cmake curl fonts-liberation2 git libdrm-dev libgl1-mesa-dev libtool nasm ninja-build pkg-config python3-venv qt6-base-dev qt6-tools-dev-tools qt6-wayland tar unzip zip

Then I need to install a bunch of needed tools that are not specified in the guide.
apt install wget lsb-release

Then I install the repositories that are needed.
Key download:
wget -O /usr/share/keyrings/llvm-snapshot.gpg.key https://apt.llvm.org/llvm-snapshot.gpg.key
Repository file added:
echo "deb [signed-by=/usr/share/keyrings/llvm-snapshot.gpg.key] https://apt.llvm.org/$(lsb_release -sc)/ llvm-toolchain-$(lsb_release -sc)-20 main" | tee -a /etc/apt/sources.list.d/llvm.list

Then the new update of the repositories triggers the bug.

Hit:1 http://deb.debian.org/debian trixie InRelease
Hit:2 http://deb.debian.org/debian trixie-updates InRelease          
Hit:3 http://deb.debian.org/debian-security trixie-security InRelease
Get:4 https://apt.llvm.org/trixie llvm-toolchain-trixie-20 InRelease [6834 B]
Err:4 https://apt.llvm.org/trixie llvm-toolchain-trixie-20 InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 6084F3CF814B57C1CF12EFD515CF4D18AF4F7421 is not bound:            No binding signature at time 2025-08-09T21:49:56Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Warning: OpenPGP signature verification failed: https://apt.llvm.org/trixie llvm-toolchain-trixie-20 InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 6084F3CF814B57C1CF12EFD515CF4D18AF4F7421 is not bound:            No binding signature at time 2025-08-09T21:49:56Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Error: The repository 'https://apt.llvm.org/trixie llvm-toolchain-trixie-20 InRelease' is not signed.
Notice: Updating from such a repository can't be done securely, and is therefore disabled by default.
Notice: See apt-secure(8) manpage for repository creation and user configuration details.

[InvalidUsernameException]

I don't think there is much that can be done on Ladybird side. It is an upstream issue that LLVM folks need to solve.

It looks like they have gotten several reports about it already:

• apt from debian trixie complains about SHA1 signature llvm/llvm-project#153385
• (packaging) apt.llvm.orgt/trixie - policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z llvm/llvm-project#179148
• LLVM repository update on Debian testing (forky) now fails llvm/llvm-project#179147

There appears to be a workaround mentioned in those issues. so that might help you.

[RedVyper]

Thanks for the help into understanding the issue at a deeper level. I guess we need to wait until upstream llvm fixes their packages, then. 🤷

[InvalidUsernameException]

You should be able to use this workaround if you don't want to wait.

[Helsinki-Vice]

The following entry seems to work on Debian 13 (shown in new .sources format):

Types: deb
URIs: https://apt.llvm.org/trixie/
Suites: llvm-toolchain-trixie-21
Components: main
Signed-By: /usr/share/keyrings/llvm-snapshot.gpg.key