Debian APT will not support SHA-1 after February 1, 2026 #28470
Description
Describe the bug
The Keybase APT repository is using SHA-1 hashes, which will be deprecated and no longer valid as of February 1, 2026.
To Reproduce
Steps to reproduce the behavior:
- Upgrade to Debian 13 ("Trixie") or later, or a comparable Debian-based OS.
- Run
apt update, orapt update --auditto see the full debugging output. - See warning. It works for now, though.
Expected behavior
Signatures should be using an algorithm from the SHA-2 or SHA-3 families, instead of an algorithm that's been getting deprecated for fifteen years.
Screenshots
Warning: https://prerelease.keybase.io/deb/dists/stable/InRelease: Policy will reject signature within a year, see --audit for details
Audit: https://prerelease.keybase.io/deb/dists/stable/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
Signing key on 222B85B0F90BE2D24CFEB93F47484E50656D16C7 is not bound:
No binding signature at time 2025-04-28T15:48:52Z
because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Audit: Repositories should provide a clear-signed InRelease file, but none found at http://linux.dropbox.com/debian/dists/trixie/InRelease.
Additional numbers
The number 345567
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
Milestone
Relationships
Development
No branches or pull requests
Participants
Activity
grrrrr commentedon Jan 21, 2026
Is there any updated on this, the day is fast approaching?
kg4zow commentedon Jan 21, 2026
You do realize that the Keybase devs don't look at these bug reports on a regular basis, right?
Keybase has a long history of not fixing bugs until just after the problem that causes the bug, happens. For example ...
For every major macOS release since 10.12 (or earlier), they haven't had a Keybase version that worked correctly with the new macOS version until, in some cases, weeks after the new macOS version was publicly released, even though they've been able to download the new versions before the public release (like any other Apple developer). The quickest update I've seen for a new macOS version was for macOS 26, and that was the next day. (I still think they need to replace the non-open source KBFS "kernel extension" with a native File Provider, but what do I know...)
The app has an SSL certificate embedded into it, which is used to detect MITM attacks. This certificate expired 2023-12-31, and when it did, every Keybase client in the world stopped working at the same time. The replacement certificate (which expires in the year 6023, this problem will NOT happen again) was committed into the code over two hours after the old one expired, it took a few more hours for the CI stuff to build new client installers, and then everybody running Keybase had to manually install the new version (because the old app's auto-update function was broken along with every other part of the old app). Good times.
In this case, where Debian is not as widely-used as other operating systems, I'm going to predict that this won't be fixed until a week or more after their repo starts failing.
To be honest, I think your best bet would be to try and find one of the Keybase devs and gently poke them via Keybase chat. Asking the question here is just screaming into the void (except that sometimes the void screams back). 😁
Good luck. (I have a handful of Debian 12 machines, I don't remember ever seeing the error message this ticket is about.)
adamhotep commentedon Jan 22, 2026
I had the http mirror in my configuration (without the SHA1 issue, this wouldn't matter thanks to the GPG sig) and therefore my web search didn't find this page. I can solve that by posting the error I got:
As @kg4zow said, it's unlikely this will get developer attention until they're wondering why their update isn't hitting Debian/Ubuntu users. I'm not sure when the Ubuntu equivalent of Debian's 2026-02-01T00:00:00Z deadline is, but that's the one that matters. It appears by looking at my Ubuntu 24.04 system that this clock hasn't even begun ticking yet. Maybe we'll have a date in the next few months when 26.04 comes out.