$ sudo apt --audit update
Hit:11 https://deb.torproject.org/torproject.org trixie InRelease
…
Warning: https://deb.torproject.org/torproject.org/dists/trixie/InRelease: Policy will reject signature within a year, see --audit for details
Audit: https://deb.torproject.org/torproject.org/dists/trixie/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
Signing key on A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 is not bound:
Policy rejected non-revocation signature (PrimaryKeyBinding) requiring second pre-image resistance
because: SHA1 is not considered secure since 2026-02-01T00:00:00Z`
Notice: Skipping acquire of configured file ‘main/binary-i386/Packages’ as repository ‘https://deb.torproject.org/torproject.org` trixie InRelease’ doesn’t support architecture ‘i386’`
$ cat /etc/apt/sources.list.d/tor.sources
Types: deb deb-src
URIs: https://deb.torproject.org/torproject.org/
Suites: trixie
Components: main
Signed-By: /usr/share/keyrings/tor-archive-keyring.gpg
Please how to fix above mentioned apt warnings and can anything be done so this is fixed for everyone, not requiring manual research and fixing for every user?
other adjustments (like updating Suites: line) in order to avoid for example “Error: Malformed stanza 1 in source list /etc/apt/sources.list.d/tor.sources (type)” during “sudo apt update”.
So I reverted the .sources file back as it was (shown in my 1st post)
It returned: “deb.torproject.org-keyring is already the newest version (2025.08.08).”
it looks as if there is no workaround except maybe waiting for a devs to update mentioned keyring package.
the keyring package for me was not installed. But you can safely remove the package and then reinstall it. IT should update correctly the key from what I experienced on my instances.
please mention the command to do it. I am up to date (apt) on Debian 13 (stable release).
$ apt list deb.torproject.org-keyring
deb.torproject.org-keyring/stable,now 2025.08.08 all [installed]
$ sudo apt update --audit
Audit: https://deb.torproject.org/torproject.org/dists/trixie/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
Signing key on A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 is not bound:
Policy rejected non-revocation signature (PrimaryKeyBinding) requiring second pre-image resistance
because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
just uninstall the package. For me, I think I alreadyd did uninstall it months ago while waiting for the fix for the problem.
So uninstall the package deb.torproject.org-keyring with a simple apt remove and then install it again . This thing has no dependencies and is not a dependency either
The line above is your problem: it does not refer to the keyring installed by the deb.torproject.org-keyring package. It’s another file, probably installed manually in the past. You should delete that old keyring file and replace the Signed-By line in your .sources file with:
got at Installation - Getting started - Tor — Tor
that command created the file and i have entered that file path in /etc/apt/sources.list.d/tor.sources that works to avoid apt update warning/error.
Please don’t use /etc/apt/trusted.gpg.d/deb.torproject.org-keyring.gpg in your sources file: this file is deprecated and will be removed eventually from the deb.torproject.org-keyring package, which will cause problems for you in the future.
If you don’t have /usr/share/keyrings/deb.torproject.org-keyring.gpg already on your system, you can follow the instructions on our support page to download (and cryptographically verify) this file.
Once you have it on your system, installing the deb.torproject.org-keyring package will ensure it is kept up to date.