After I upgraded my apt to 3.0.3, “apt update” starts to show: Warning: https://deb.torproject.org/torproject.org/dists/trixie/InRelease: Policy will reject signature within a year, see --audit for details Audit: https://deb.torproject.org/torproject.org/dists/trixie/InRelease: Sub-process /usr/bi…

Signing Key Insecure? The Tor team is using at least 3 message-digest algorithms (SHA256, SHA1, MD5), some of them, SHA1 and MD5 are not considered secure. view-source:https://deb.torproject.org/torproject.org/dists/trixie/InRelease [image] BobbyB: [image] g0l4: SHA1 is not considered s…

[image] g0l4: SHA1 is not considered secure since 2026-02-01T00:00:00Z Today is 2025-08-12; 2026 is in the future. A typo maybe? https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm

[image] Protium_serratum: Package manager APT said “Policy will reject signature within a year, see --audit for details” I don’t understand this response. The writer said since 2026-02-01T00:00:00Z. Since implies previous to today. My question was “is this a typo?” as in a year previous to t…

Sorry, I’m not familiar with apt, file InRelease is not related to this warning, intrigeri’s comments may help [image] Debian repository: policy will reject signature within a year: SHA1 is not... apt is unhappy about the signing key, as shipped by deb.torproject.org-keyring, used for si…

Signing Key Insecure?

Support Core Tor

g0l4 August 13, 2025, 5:36am 5

Thanks. I updated my “deb.torproject.org-keyring” and this warning disappears.

Warning on stable Linux Debian by APT: Policy will reject signature within a year. SHA1 is not considered secure