APT repository signing key uses SHA1, rejected by Debian Trixie

[glamberson]

Description

The Amazon Corretto APT repository signing key uses SHA1 binding signatures, which are now rejected by Debian Trixie's apt (using Sequoia/sqv for verification) as of February 1, 2026.

Current Behavior

$ sudo apt update
Err:7 https://apt.corretto.aws stable InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 6DC3636DAE534049C8B94623A122542AB04F24E3 is not bound:
  No binding signature at time 2026-01-28T23:20:37Z
  because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
  because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

Key Analysis

$ curl -fsSL https://apt.corretto.aws/corretto.key | gpg --list-packets 2>&1 | grep 'digest algo'
	digest algo 8, begin of digest 7e 19
	digest algo 2, begin of digest 70 a2

Digest algo 2 is SHA1. The key contains at least one SHA1 self-signature which is rejected by Sequoia's policy.

Expected Behavior

The repository signing key should use SHA256 (algo 8) or stronger for all self-signatures, including UID binding signatures.

Environment

• Distribution: Debian Trixie (testing)
• Repository: https://apt.corretto.aws
• Affected key: 6DC3636DAE534049C8B94623A122542AB04F24E3

Solution

Please regenerate or refresh the GPG key self-signatures using SHA256 or SHA512.

Workaround

Users can temporarily extend the SHA1 policy deadline in /etc/crypto-policies/back-ends/sequoia.config:

[hash_algorithms]
sha1.second_preimage_resistance = 2027-01-01

References

• Sequoia SHA1 policy: https://gitlab.com/sequoia-pgp/sequoia/-/issues/595
• Similar issue at NodeSource: Debian repository signing key uses SHA1, will be rejected by apt policy in February 2026 nodesource/distributions#1908

[elifaslan1]

Thanks for reporting this. I'm unable to reproduce the SHA1 signature rejection in my Debian Trixie environment. To help diagnose, could you run this command and share the output?

{
  echo "=== System Info ==="
  cat /etc/debian_version
  apt --version
  date -u
  echo ""
  echo "=== Sequoia Version ==="
  dpkg -l | grep -E 'sqv|sequoia'
  echo ""
  echo "=== Repository Config ==="
  cat /etc/apt/sources.list.d/corretto.list 2>/dev/null || echo "No corretto.list found"
  ls -la /usr/share/keyrings/corretto* 2>/dev/null || echo "No corretto keyring found"
  echo ""
  echo "=== Key Signature Check ==="
  curl -fsSL https://apt.corretto.aws/corretto.key | gpg --list-packets 2>&1 | grep 'digest algo'
  echo ""
  echo "=== Sequoia Policy ==="
  sqv --version
  ls -la /etc/apt/apt.conf.d/ | grep -i seq
  echo ""
  echo "=== Fresh apt update ==="
  sudo rm -rf /var/lib/apt/lists/*
  sudo apt update 2>&1
} | tee corretto-debug.txt

Also please compare your keyring vs server

gpg --list-packets /usr/share/keyrings/corretto-keyring.gpg 2>&1 | grep 'digest algo'

curl -fsSL https://apt.corretto.aws/corretto.key | gpg --list-packets 2>&1 | grep 'digest algo'

if the problem is your local keyring you can update by:

sudo rm /usr/share/keyrings/corretto-keyring.gpg
wget -O- https://apt.corretto.aws/corretto.key | sudo gpg --dearmor -o /usr/share/keyrings/corretto-keyring.gpg
sudo apt update

[elifaslan1]

Also following Corretto documentation should resolve the issue.

wget -O - https://apt.corretto.aws/corretto.key | sudo gpg --dearmor -o /usr/share/keyrings/corretto-keyring.gpg && \
echo "deb [signed-by=/usr/share/keyrings/corretto-keyring.gpg] https://apt.corretto.aws stable main" | sudo tee /etc/apt/sources.list.d/corretto.list