On Sat, Oct 10, 2026 at 01:16:43PM +0200, Bill Allombert wrote: > Dear Debian developers, > > Is there any way to replace a SHA1 self-binding signature in a GPG public key > ? > > I get the message > dpkg-source: info: verifying ../pari_2.19.0.orig.tar.gz.asc > Signing key on 42028EA404A2E9D80AC453148F0E7C2B4522E387 is not bound: > No binding signature at time 2026-09-28T08:47:24Z > because: Policy rejected non-revocation signature (PositiveCertification) > requiring second pre-image resistance > because: SHA1 is not considered secure since 2023-02-01T00:00:00Z > dpkg-source: warning: cannot verify upstream tarball signature for > ../pari_2.19.0.orig.tar.gz: no acceptable signature found > > (this key is in the Debian keyring) > > Should I rather generate a new key ?
https://wiki.debian.org/FixKeyWithSha1 should help. J. -- /-\ | "who amongst us has not at one |@/ Debian GNU/Linux Developer | time or another borked the glob" \- | -- paultag
signature.asc
Description: PGP signature
