APT signature verification fails: SHA-1 rejected by modern security policies (2026-02-01 deprecation)

[antoniusz]

After the 2026-02-01 SHA-1 deprecation deadline, APT fails to update repositories hosted on OBS (like GPXSee) because the signatures or key bindings still use SHA-1.

The error:
An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: https://dbeaver.io/debs/dbeaver-ce InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 98F5A7CC1ABE72AC3852A007D33A1BD725ED047D is not bound: No binding signature at time 2026-01-18T18:02:18Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00ZAn error occurred during the signature verification. The repository is not updated and the previous index files will be used.

This issue was first reported to the GPXSee maintainer here: tumic0/GPXSee#638

The maintainer confirmed that the repository creation and signing process is handled by OBS, and therefore the fix must be implemented at the infrastructure level to support modern security policies (SHA-1 deprecation as of 2026-02-01).

[antoniusz]

The InRelease file from OBS shows it was signed using GnuPG v1.0.7 (from 2002!). While the digest algorithm for the file is SHA-256, the key binding signatures are still using SHA-1. Modern security policies (like Sequoia-PGP on my system) reject the key because these internal SHA-1 bindings are no longer considered secure as of 2026-02-01. Please update the OBS signing infrastructure to use modern GPG versions and SHA-256/512 for key bindings.

gpg --verify --verbose download.opensuse.org_repositories_home:_tumic:_GPXSee_Debian%5f13_InRelease
gpg: enabled debug flags: memstat
gpg: enabled compatibility flags:
gpg: armor header: Hash: SHA256
gpg: armor header: Version: GnuPG v1.0.7 (GNU/Linux)
gpg: original file name=''
gpg: Signature made Mon Jan 26 08:42:06 2026 EET
gpg: using RSA key EB0D25C9B4D88129000AE36018D244F4B89A4627
gpg: using pgp trust model
gpg: Good signature from "home:tumic OBS Project home:tumic@build.opensuse.org" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: EB0D 25C9 B4D8 8129 000A E360 18D2 44F4 B89A 4627
gpg: textmode signature, digest algorithm SHA256, key algorithm rsa2048
gpg: keydb: handles=1 locks=0 parse=1 get=1
gpg: build=0 update=0 insert=0 delete=0
gpg: reset=0 found=1 not=0 cache=0 not=0
gpg: kid_not_found_cache: count=0 peak=0 flushes=0
gpg: sig_cache: total=1 cached=1 good=1 bad=0
gpg: objcache: keys=1/1/0 chains=382,1..1 buckets=383/20 attic=255
gpg: objcache: uids=1/1/0 chains=106,1..1 buckets=107/20
gpg: random usage: poolsize=600 mixed=4 polls=0/3 added=24/1472
outmix=2 getlvl1=1/8 getlvl2=0/0
gpg: rndjent stat: collector=0x0000000000000000 calls=0 bytes=0
gpg: secmem usage: 1344/65536 bytes in 2 blocks

[mlschroe]

The gpg version is fake. We do not use gpg for signing. Maybe we should just drop the version.

Of course we already support sha256 key binding signatures. The code just kept the old algorithm when extending a a key expiration date. This was changes some months ago, so just extending the key (osc signkey --extend) will make the binding sig use sha256.