apt update fails on Debian 13 (Trixie): SHA1 signing key rejected by sqv since 2026-02-01

[holzi1005]

Bug

Running apt update on Debian 13 (Trixie) fails for the GlusterFS repository with the following error:

Err:2 https://download.gluster.org/pub/gluster/glusterfs/11/LATEST/Debian/trixie/amd64/apt trixie InRelease
Sub-process /usr/bin/sqv returned an error code (1), error message is:
Signing key on F9C958A3AEE0D2184FAD1CBD43607F0DC2F8238C is not bound:
No binding signature at time 2023-11-08T14:04:10Z because:
Policy rejected non-revocation signature (PositiveCertification)
requiring second pre-image resistance because:
SHA1 is not considered secure since 2026-02-01T00:00:00Z

Root cause

Debian 13 uses sqv as the default OpenPGP verifier instead of gpg. As of 2026-02-01, sqv enforces a strict policy that rejects signatures bound with SHA1. The GlusterFS repository key (F9C958A3AEE0D2184FAD1CBD43607F0DC2F8238C) uses a SHA1-based binding signature, making it incompatible with this policy.

Steps to reproduce

1. Install Debian 13 (Trixie)

2. Add the GlusterFS 11 repository:
   curl -fsSL https://download.gluster.org/pub/gluster/glusterfs/11/rsa.pub |
   gpg --dearmor | sudo tee /etc/apt/trusted.gpg.d/glusterfs.gpg > /dev/null
   echo "deb https://download.gluster.org/pub/gluster/glusterfs/11/LATEST/Debian/trixie/amd64/apt trixie main"
   | sudo tee /etc/apt/sources.list.d/glusterfs.list
   sudo apt update

3. Observe the error above.

Expected behaviour

apt update completes successfully and the GlusterFS repository is reachable.

Actual behaviour

apt update fails with an sqv policy error because the repository signing key uses SHA1.

Environment

OS: Debian GNU/Linux 13 (Trixie)
GlusterFS: 11 (LATEST)
Repo URL: https://download.gluster.org/pub/gluster/glusterfs/11/LATEST/Debian/trixie/amd64/apt
Affected key: F9C958A3AEE0D2184FAD1CBD43607F0DC2F8238C
sqv version: system default on Trixie (replaces gpg for apt key verification)

Suggested fix

Re-sign the repository key using SHA256 or stronger (e.g. SHA512) and publish a new key fingerprint. The current key's binding signature was created on 2023-11-08 with SHA1, which is now rejected by sqv's policy enforced since 2026-02-01.

Workaround (until fixed)

Force apt to use gpg instead of sqv:
echo 'APT::Key::GPGCommand "/usr/bin/gpg";' | sudo tee /etc/apt/apt.conf.d/99use-gpg-not-sqv
echo "weak-digest SHA1" | sudo tee -a /etc/gnupg/gpg.conf
sudo apt update

References

• Sequoia-PGP SHA1 policy: https://sequoia-pgp.org/blog/2023/02/01/202302-happy-sha1-day/
• Debian 13 change to sqv: https://tracker.debian.org/news/1480077/accepted-apt-291-source-into-unstable/