Debian repositories still using SHA1, which policy no longer allows as of 02/01/26

[kyrofa]

Describe your bug
Using https://deb.nodesource.com/node_16.x nodistro, as of 02/01/26 Debian no longer wants to install from it, saying the following:

OpenPGP signature verification failed: https://deb.nodesource.com/node_16.x nodistro InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 6F71F525282841EEDAF851B42F59B5F99B1BE0B4 is not bound: No binding signature at time 2026-01-19T15:28:54Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

Distribution Information:

Debian 13 (Trixie)

Node Version:
16

[kyrofa]

This is related to #1908, which it appears was never fully fixed.

[kyrofa]

For anyone currently blocked by this (we suddenly couldn't ship to prod), this should unblock you for a month:

$ sed -i 's/sha1.second_preimage_resistance.*/sha1.second_preimage_resistance = 2026-03-01/' /usr/share/apt/default-sequoia.config

[cweiland]

as mentioned in #1908 (tested on Debian 13.2 with node24.x)

KEYFILE=$(awk '/^Signed-By: (.+)$/ {print $2}' /etc/apt/sources.list.d/nodesource.sources)
curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o "${KEYFILE}"

[kyrofa]

I can confirm as well, looks like things are working now. Why the silence, folks?

[GasTurbineMan]

Did the @kyrofa work around on my Raspberry Pi running Trixie. Still tells me

Warning: https://deb.nodesource.com/node_20.x/dists/nodistro/InRelease: Policy will reject signature within a year, see --audit for details Summary: Upgrading: 0, Installing: 0, Removing: 0, Not Upgrading: 0
Is this the current state of the "fix"?

[gibsonmb]

as mentioned in #1908 (tested on Debian 13.2 with node24.x)

KEYFILE=$(awk '/^Signed-By: (.+)$/ {print $2}' /etc/apt/sources.list.d/nodesource.sources) curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o "${KEYFILE}"

I don't have "nodesources.sources" file, only a 'nodesources.list' file within it is a reference to node20.x. I've upgraded from bookworm to trixie. The command above, even if a change the filename to nodesource.list does not seem to fix the issue. Can anybody help?