Missing signing key for repo archive.raspberrypi.com since this morning 2026/02/01

[fguiet]

Bump to this error this morning...

Err:9 http://archive.raspberrypi.com/debian trixie InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CF8A1AF502A2AA2D763BAE7E82B129927FA3303E is not bound:            No binding signature at time 2026-01-29T17:03:28Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

This error comes from rpi-debian-trixie

# METABEGIN
# X-Env-Layer-Name: rpi-debian-trixie
# X-Env-Layer-Provides: rpi-debian
# X-Env-Layer-Desc: Raspberry Pi Debian Trixie APT repository
# X-Env-Layer-Version: 1.0.0
# METAEND
---
mmdebstrap:
  mirrors:
    - deb http://archive.raspberrypi.com/debian trixie main
  packages:
    - raspberrypi-archive-keyring
  customize-hooks:
    - test -f $1/usr/share/keyrings/raspberrypi-archive-keyring.gpg || false
    - mkdir -p $1/etc/apt/sources.list.d
    - |-
      cat <<- EOF > $1/etc/apt/sources.list.d/raspberrypi.list
      deb [signed-by=/usr/share/keyrings/raspberrypi-archive-keyring.gpg] http://archive.raspberrypi.com/debian trixie main
      EOF
    - sed -i '/archive\.raspberrypi\.com/d' $1/etc/apt/sources.list

[fguiet]

Hey,

Quick ugly fix for me, change in rip-debian-trixie layer

deb http://archive.raspberrypi.com/debian trixie main

by

deb [trusted=yes] http://archive.raspberrypi.com/debian trixie main

Seeya,
fred

[stu-spp]

Me too. Here is a bit more log for context.

I: running apt-get update...
Get:1 http://deb.debian.org/debian trixie InRelease [140 kB]
Get:2 http://deb.debian.org/debian-security trixie-security InRelease [43.4 kB]
Get:3 http://deb.debian.org/debian trixie-updates InRelease [47.3 kB]
Get:4 http://deb.debian.org/debian trixie/non-free arm64 Packages [74.4 kB]
Get:5 http://deb.debian.org/debian trixie/main arm64 Packages [9607 kB]
Get:6 http://deb.debian.org/debian trixie/non-free-firmware arm64 Packages [6484 B]
Get:7 http://deb.debian.org/debian trixie/contrib arm64 Packages [48.4 kB]
Get:8 http://deb.debian.org/debian trixie/main armhf Packages [9238 kB]
Get:9 http://deb.debian.org/debian trixie/contrib armhf Packages [42.6 kB]
Get:10 http://deb.debian.org/debian trixie/non-free armhf Packages [57.1 kB]
Get:11 http://deb.debian.org/debian trixie/non-free-firmware armhf Packages [6132 B]
Get:12 http://deb.debian.org/debian-security trixie-security/main arm64 Packages [99.0 kB]
Get:13 http://deb.debian.org/debian-security trixie-security/main armhf Packages [93.0 kB]
Get:14 http://deb.debian.org/debian trixie-updates/main arm64 Packages [5404 B]
Get:15 http://deb.debian.org/debian trixie-updates/main armhf Packages [5144 B]
Get:16 http://archive.raspberrypi.com/debian trixie InRelease [54.8 kB]
Err:16 http://archive.raspberrypi.com/debian trixie InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CF8A1AF502A2AA2D763BAE7E82B129927FA3303E is not bound:            No binding signature at time 2026-01-29T17:03:28Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Reading package lists...
W: OpenPGP signature verification failed: http://archive.raspberrypi.com/debian trixie InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CF8A1AF502A2AA2D763BAE7E82B129927FA3303E is not bound:            No binding signature at time 2026-01-29T17:03:28Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
E: The repository 'http://archive.raspberrypi.com/debian trixie InRelease' is not signed.

[learmj]

Hi. I can't reproduce this this morning. I successfully built a Trixie image (config/trixie-minbase.yaml) from arm64 Bookworm and Trixie systems, and an Ubuntu system running on an x86 box.
The arm Trixie system started at zero as a minbase Debian container that has the RPi apt repo spec and signing key pre-installed. The Ubuntu system doesn't have any RPi keys or apt repo spec installed.

Please supply your work/bootstrap/host.json.

[alejohub]

I'm experiencing the same sqv error on two live Raspberry Pi systems running Debian Trixie (armhf). The issue started appearing after Feb 1st, 2026. It seems to be a runtime enforcement of the SHA1 deprecation policy.

Here is the technical info from my systems:

Raspberry Pi 3:

--- SYSTEM INFO ---
PRETTY_NAME="Raspbian GNU/Linux 13 (trixie)"
armv7l
apt 3.0.3 (armhf)
sqv 1.3.0 (sequoia-openpgp 2.0.0, using Nettle 3.10 (Cv448: true, OCB: true))
Mon Feb  2 14:21:53 CET 2026
--- REPO ERROR ---
Get:3 http://archive.raspberrypi.com/debian trixie InRelease [54.8 kB]
Ign:3 http://archive.raspberrypi.com/debian trixie InRelease
Fetched 75.3 kB in 0s (228 kB/s)
Reading package lists...
Building dependency tree...
Reading state information...
All packages are up to date.
Warning: OpenPGP signature verification failed: http://archive.raspberrypi.com/debian trixie InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CF8A1AF502A2AA2D763BAE7E82B129927FA3303E is not bound:            No binding signature at time 2026-01-29T17:03:28Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
root@raspberrypi3:~#

Raspberry Pi 2:

--- SYSTEM INFO ---
PRETTY_NAME="Raspbian GNU/Linux 13 (trixie)"
armv7l
apt 3.0.3 (armhf)
sqv 1.3.0 (sequoia-openpgp 2.0.0, using Nettle 3.10 (Cv448: true, OCB: true))
Mon Feb  2 14:21:37 CET 2026
--- REPO ERROR ---
Get:3 http://archive.raspberrypi.com/debian trixie InRelease [54.8 kB]
Ign:3 http://archive.raspberrypi.com/debian trixie InRelease
Fetched 75.3 kB in 2s (43.9 kB/s)
Reading package lists...
Building dependency tree...
Reading state information...
All packages are up to date.
Warning: OpenPGP signature verification failed: http://archive.raspberrypi.com/debian trixie InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CF8A1AF502A2AA2D763BAE7E82B129927FA3303E is not bound:            No binding signature at time 2026-01-29T17:03:28Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
root@raspberrypi2:~#

The error message specifically mentions: SHA1 is not considered secure since 2026-02-01T00:00:00Z. This confirms it's a policy rejection by the sqv (Sequoia) backend used by apt in Trixie."

Workaround

sudo mkdir -p /etc/crypto-policies/back-ends
echo -e '[hash_algorithms]\nsha1 = "always"' | sudo tee /etc/crypto-policies/back-ends/sequoia.config
sudo rm -rf /var/lib/apt/lists/*

[LorandMarton]

same issue:

I: running apt-get update...
done
Get:1 http://deb.debian.org/debian bookworm InRelease [151 kB]
Get:2 http://archive.raspberrypi.com/debian bookworm InRelease [54.9 kB]
Get:3 http://deb.debian.org/debian-security bookworm-security InRelease [48.0 kB]
Get:4 http://deb.debian.org/debian bookworm-updates InRelease [55.4 kB]
Get:5 http://deb.debian.org/debian bookworm/contrib arm64 Packages [45.7 kB]
Err:2 http://archive.raspberrypi.com/debian bookworm InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CF8A1AF502A2AA2D763BAE7E82B129927FA3303E is not bound:            No binding signature at time 2026-01-27T13:42:25Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Get:6 http://deb.debian.org/debian bookworm/non-free-firmware arm64 Packages [5832 B]
Get:7 http://deb.debian.org/debian bookworm/main arm64 Packages [8691 kB]
Get:8 http://deb.debian.org/debian bookworm/non-free arm64 Packages [75.8 kB]
Get:9 http://deb.debian.org/debian-security bookworm-security/main arm64 Packages [288 kB]
Get:10 http://deb.debian.org/debian-security bookworm-security/contrib arm64 Packages [508 B]
Get:11 http://deb.debian.org/debian bookworm-updates/main arm64 Packages [6936 B]
Reading package lists...
W: OpenPGP signature verification failed: http://archive.raspberrypi.com/debian bookworm InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CF8A1AF502A2AA2D763BAE7E82B129927FA3303E is not bound:            No binding signature at time 2026-01-27T13:42:25Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
E: The repository 'http://archive.raspberrypi.com/debian bookworm InRelease' is not signed.
E: apt-get update --error-on=any -oAPT::Status-Fd=<$fd> -oDpkg::Use-Pty=false failed: process exited with 100 and error in console output
W: hooklistener errored out: E: received eof on socket

I: main() received signal PIPE: waiting for setup...

[learmj]

#173 should fix this problem. Please verify and let me know.

[LorandMarton]

As a temporary workaround, I added this to my top-level layer. I will verify the fix.

mmdebstrap:
  aptopts:
    - APT::Key::GPGVCommand "/usr/bin/gpgv"

[fguiet]

Hi @learmj

#173 fix the problem, I have just test it

Thank you
fred

[boscorelly]

hi,
i had the same problem today.
updated bookworm.
changed repo to trixie : repo unsigned for archive.

[learmj]

Hi. Please provide your reproduction steps. If the image is created (built) using a version of the tool with this fix, the problem won't happen. The problem only happens when older versions of the tool used a key (whose attribute expired) at image build time. Image build installs the rpi keyring package which will install an up to date key into the chroot for the image to use at runtime. The problem is limited to image build only (ie when the host machine apt uses the key), and not when updating inside a running image (ie when apt in the image or on the device uses the key installed by the rpi keyring package).