<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/153385>153385</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            apt from debian trixie complains about SHA1 signature
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          t-b
      </td>
    </tr>
</table>

<pre>
    ```
$apt --version
apt 3.0.3 (amd64)
```

With a LLVM sources entry like

```
Types: deb deb-src
URIs: http://apt.llvm.org/trixie/
Suites: llvm-toolchain-trixie-20
Components: main
Signed-By: /etc/apt/keyrings/llvm.gpg
```

and when I do

```
LC_ALL=C sudo apt update --audit
```

I get the warning

```
Warning: http://apt.llvm.org/trixie/dists/llvm-toolchain-trixie-20/InRelease: Policy will reject signature within a year, see --audit for details
Audit: http://apt.llvm.org/trixie/dists/llvm-toolchain-trixie-20/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
 Signing key on 6084F3CF814B57C1CF12EFD515CF4D18AF4F7421 is not bound:
 No binding signature at time 2025-08-09T21:49:56Z
     because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
     because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
```
</pre>
<img width="1" height="1" alt="" src="http://email.email.llvm.org/o/eJy0lFGPozYQxz-N8zIiMgYSeOCBZYu6Ulqdbrc96V4qgycwXbA52yTNt69Mcrmtdh_6clESCXv8n_nP_LB0jnqNWLLsgWWPG7n4wdjSR-2mNepSsh2_fXnFRCpnD1F0QuvIaMar8Jxs-TYBJnI5qV3KRBFC3x7j1RfyA0g4HP78DZxZbIcOUHt7gZFe8Rrz9sjLZUbHkgoUtuEXOdsxXv3x-WldHbyfWVIx0TDRyNlvx_E0bY3tmWi8pX8IwxavnhfyV50QEHljxm6QpKNrUCRCrtpMs9Go_Ro4SQq-nkNTVPRwCWtMNOi7ayommle8WNK9Y6JZ8_Zz_96x1ArOA2p4AmXeGzzUf1WHA0sea3CLMhD6uMxKeoQokosi_17yCXr04AeEs7SadP9e9stt4__2SJHz33182B7RPOnPOKJ0GEQ_mZG6C5xpHMHi39h5CPhIv1iEM_mBNEi4oLRM1ODw7gaOxoJCL2l0jFfV6vBnVfm8tNFsTYfOhdktzjLRtKSZaNy3E1j0i9WoQGpAa42FzigMAMcBXlHfVid0TvYIFMBgvIIABekeXvECRsOO52mT1E0epw_Zvo7rJha_NI9ZnNVN-hjnVZM2-1TEQA608dCaRaub1O8GWtIqqP1ooPTgaUIQXGQRzyNevIiYJVVasKTKdl_DwfBpsZPLfwZynQUq0EZHFk-mk56MfqPNRP7JOPJ0whqtpyNdQ5gowOK3hexaC3ZGK5gtRjQF7xYdOS91hx8kf_61upvrjHak0KIKIiGjI92tXnYRFxGPXzhnSXX7-_oW3I0qE1UkhdxgGe-zjOdxwYvNULayUJmQaodxIvex2sXH3T7fZYXAPFXFcUNl6BXP4yTmacaLLT-qvE32SiaiK1LVsZTjJGm8c7Uh5xYs4yxJ8mwzyhZHt959Qmg8w7rLhAhXoS1X4NqldyzlY4Dwh4wnP2IZXtujNVO4o0hquCIJnZnmUZJ2IFuz-Guj7rPYLHYsA_juTn5PfljabWemG-bfaZ-tCZNlolkrC2_BrfRTKf4NAAD___mwyrE">