Additional reproduction evidence for Debian bug #1143813 (apt-cacher-ng / InRelease signature verification)
On October 13, 2026, I reproduced this issue on two Debian 13 (Trixie) systems sharing the same apt-cacher-ng instance: - Raspberry Pi 5 (arm64): apt-cacher-ng on port 3142; APT proxy http://127.0.0.1:3142 - Debian desktop (amd64): APT HTTP proxy http://192.168.50.1:3142 - Affected repository: http://deb.debian.org/debian trixie-updates - Cache entry: /var/cache/apt-cacher-ng/debrep/dists/trixie-updates/InRelease Both machines reported: Sub-process /usr/bin/sqv returned an error code (1) Verifying signature: Message has been manipulated Findings: 1. The bad InRelease file in apt-cacher-ng's cache had SHA-256: 706c13b5902fb74271db07319a366e929c58e9e3523edaae9ff48bf2a57079f5 The Raspberry Pi's failed APT download had this same checksum. 2. The good copy, downloaded directly from Debian, had SHA-256: 7348aa608c589b8d6421e8311f69deba685235a87681abe1879981f846f9122d 3. A diff showed identical repository metadata, with differences confined to the ASCII-armored PGP signature block. The bad copy failed independent sqv verification; the good copy verified successfully against Debian's archive keys. 4. On the Pi, moving aside the local failed APT partial file and bypassing the proxy allowed apt update to succeed. On the desktop, moving aside the failed local partial file and retrying through the proxy continued to fail. 5. I stopped apt-cacher-ng, moved the cache's InRelease and InRelease.head files into a backup directory, and restarted the service. Normal apt update then succeeded on both the Pi and desktop (after moving aside the desktop's failed partial file). The shared cache demonstrably held the invalid metadata, but I have not established how the mismatched signature entered the cache. The attached apt-cacher-ng-evidence-20261013.tar.xz contains bad.InRelease and good.InRelease with the SHA-256 hashes above. The original cache header is preserved separately but not attached. I hope these files help diagnose the underlying issue.
apt-cacher-ng-evidence-20261013.tar.xz
Description: Unix tar archive
