Problem description
Documentation at https://openresty.org/en/linux-packages.html#debian advises to use the key https://openresty.org/package/pubkey.gpg as a repo signing key.
On Debian 13, this leads to the following warning
Warning: http://openresty.org/package/debian/dists/bookworm/InRelease: Policy will reject signature within a year, see --audit for details
Details from running with --audit
Audit: http://openresty.org/package/debian/dists/bookworm/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
Signing key on E52218E7087897DC6DEA6D6D97DB7443D5EDEB74 is not bound:
No binding signature at time 2025-06-21T11:08:29Z
because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Underlying cause
Internally, apt uses "Sequoia PGP" to verify signatures - hence the message that /usr/bin/sqv returned an error code in my example above. By default, sqv is configured to accept the (old and broken) SHA1 hash algorithm only until Feb 1st 2026.
How to resolve this issue
There's nothing you can do besides raising awareness for this issue.
This issue can only be resolved by the openresty team, who need to change their repo signing key to one that does not use SHA1.
How to temporarily suppress this warning until this repo uses another key
To reconfigure sqv, copy /usr/share/apt/default-sequoia.config to /etc/crypto-policies/back-ends/apt-sequoia.config, and change the date in the last line from 2026-02-01 to ex. 2027-02-01. (more)
Please think about possible implications and do not forget to revert this, once the openresty team has switched to another key.
Problem description
Documentation at https://openresty.org/en/linux-packages.html#debian advises to use the key
https://openresty.org/package/pubkey.gpgas a repo signing key.On Debian 13, this leads to the following warning
Warning: http://openresty.org/package/debian/dists/bookworm/InRelease: Policy will reject signature within a year, see --audit for detailsDetails from running with --audit
Underlying cause
Internally, apt uses "Sequoia PGP" to verify signatures - hence the message that
/usr/bin/sqvreturned an error code in my example above. By default, sqv is configured to accept the (old and broken) SHA1 hash algorithm only until Feb 1st 2026.How to resolve this issue
There's nothing you can do besides raising awareness for this issue.
This issue can only be resolved by the openresty team, who need to change their repo signing key to one that does not use SHA1.
How to temporarily suppress this warning until this repo uses another key
To reconfigure
sqv, copy/usr/share/apt/default-sequoia.configto/etc/crypto-policies/back-ends/apt-sequoia.config, and change the date in the last line from 2026-02-01 to ex. 2027-02-01. (more)Please think about possible implications and do not forget to revert this, once the openresty team has switched to another key.