Debian repo signing key needs upgrading from SHA-1

[BartMassey]

Running apt update on my recent Debian box gets warnings about the zulip-desktop repo.

Warning: https://download.zulip.com/desktop/apt/dists/stable/InRelease: Policy will reject signature within a year, see --audit for details
Audit: https://download.zulip.com/desktop/apt/dists/stable/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
   Signing key on 69AD12704E71A4803DCA3A682424BE5AE9BD10D9 is not bound:
              No binding signature at time 2025-03-13T21:39:32Z
     because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
     because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

This is pretty standard for outdated keys. The key in question was obtained per the Zulip instructions via

curl -fL -o /etc/apt/keyrings/zulip-desktop.asc  \
  https://download.zulip.com/desktop/apt/zulip-desktop.asc

My zulip-desktop.sources file contains

Types: deb
URIs: https://download.zulip.com/desktop/apt/
Suites: stable
Components: main
Signed-By: /etc/apt/keyrings/zulip-desktop.asc
Architectures: amd64

The GPG key I obtained is:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBFmdzvQBCADJ4BFlK+4ymIWa3jrNL0WfGPV3dVkZ1Ghy5MsgRIs81CpVS83m
kyBLULY551GNwuHZaeXbkaA+cTDyhEPBFr0MTF0gO514escnjwcL7U1UCLA4I0WP
0yETXLHp7HFh4g+MZpObkgmLP55aV3jqgNK/p05umrhECBl1HJo+8T+0VNi2x1Pm
LoJVvA7uJHcsNaQVWQF4RP0MaI4TLyjHZAJlpthQfbmq0AbZMEjDu8Th5G9KTsqE
WRyFoAj/SWwKQK2U4xpnA6jEraMcvsYYQMrCXlG+MOV7zVknLrH5tfk7JlmWB4DV
cs+QP5Z/UrVu+YpTpaoJoZV6LlEU1kNGjtq9ABEBAAG0TVp1bGlwIEFQVCBSZXBv
c2l0b3J5IFNpZ25pbmcgS2V5IEJpbnRyYXkgKFByb2R1Y3Rpb24pIDxzdXBwb3J0
QHp1bGlwY2hhdC5jb20+iQE4BBMBAgAiBQJZnc70AhsDBgsJCAcDAgYVCAIJCgsE
FgIDAQIeAQIXgAAKCRAkJL5a6b0Q2Vg1CADJzrH0mbwKi5GiHo5+iX5/WuUkSA8S
lI7FWzkbnPD0sfxJBwBNhZnAALQUvCybHxoU8VZ5ZbU1vbU+EG7pUMzENZLgEhoC
MDl1j8uCSahjjO+bk8qHhgM1FUKpoGec2wKfPKpcz1P+/bLTRKe7aqilkPSYOjeV
u8JI713zRL0nHd9vYZDoN2HR30J5sqgjRHtK5okNhiFG+pF3HFATG7nbNOa/tv+q
ZvhbI/5S8P5VKPSK/1lmMh0UFyNIbPg6MvWiqnfy7DAvOZGJpawkiN2B0XhNZKZR
KKXvFk3qvFpNTCUrH77MlPgjn+oRbE9SYm0phj0o2jQi/s1s2r75tk/ZuQENBFmd
zvQBCACv7VNQ6x3hfaRl8YF8bbrWXN2ZWxEa353p4QryHODsa7wHtsoNR3P30TIL
yafjjcV8P6dzyDw6TpfRqqQDKLY6FtznT2HdceQSffGTXB4CRV7KURBqh81PX/Jo
dz0NwkNrd0NWqkk6BnLX6U5tGuYiqC3vLpjOHmVQezJ41xpf85ElJ2nBW0rEcmfk
fwQthJU7BbqWKd6nbt2G+xWkCVoN6q+CWLXtK0laHMKBGQnoiQpldotsKM8UnDeQ
XPqrEi28ksjVW8tBStCkLwV2hCxk49zdTvRjrhBTQ1Ff/kenuEwqbSERiKfA7I8o
mlqulSiJ6rYdDnGjNcoRgnHb50hTABEBAAGJAR8EGAECAAkFAlmdzvQCGwwACgkQ
JCS+Wum9ENnsOQgApQ2+4azOXprYQXj1ImamD30pmvvKD06Z7oDzappFpEXzRSJK
tMfNaowG7YrXujydrpqaOgv4kFzaAJizWGbmOKXTwQJnavGC1JC4Lijx0s3CLtms
OY3EC2GMNTp2rACuxZQ+26lBuPG8Nd+rNnP8DSzdQROQD2EITplqR1Rc0FLHGspu
rL0JsVTuWS3qSpR3nlmwuLjVgIs5KEaOVEa4pkH9QwyAFDsprF0uZP8xAAs8WrVr
Isg3zs7YUcAtu/i6C2jPuMsHjGfKStkYW/4+wONIynhoFjqeYrR0CiZ9lvVa3tJk
BCeqaQFskx1HhgWBT9Qqc73+i45udWUsa3issg==
=YJGK
-----END PGP PUBLIC KEY BLOCK-----

I looked around for how and where the Zulip Debian repo is built, but didn't have any luck. Let me know, and I may be able to provide some advice on fixing this if you want it.

Thanks much for Zulip Desktop.

[m4lvin]

I can confirm this. And I think more people will run into this warning with the release for Debian 13 "trixie" in one week from now.

[alarcritty]

Hi @BartMassey , I'd like to work on this issue. Is it still open?

[BartMassey]

As far as I know. I don't have any real connection to the Zulip project

[alya]

Thanks for the report, @BartMassey ! We'll be rotating the signing key with some care to avoid an unpleasant upgrade process.

[alya]

@alarcritty As noted in the contributor guide, please choose an issue with the "help wanted" label.

[alarcritty]

@alarcritty As noted in the contributor guide, please choose an issue with the "help wanted" label.

okay thanks.

[BartMassey]

Thank you!