Debian Trixie: apt update fails for Eddie repo since 2026-02-01 (SHA1 rejected)

[airxirtir 0]

Hi,

since 2026-02-01 my Debian Trixie system can’t update the Eddie APT repo. Debian repos are fine, only eddie.website fails.

Error: http://eddie.website/repository/apt stable InRelease
sqv: Policy rejected signature because SHA1 is not considered secure since 2026-02-01T00:00:00Z
Key: C181AC89FA667E317F423998513EFC94400D7698

Is there an updated repo signing key / re-signed InRelease available (SHA256+), or a recommended fix/workaround until it’s updated?

Thanks!

[guest34875 0]

Had this Problem yesterday too and found a Workaround. 
Treat this as a temporary workaround.

apt uses "Sequoia PGP" to verify signatures. By default, sqv is configured to accept the SHA1 hash algorithm only until Feb 1st 2026. 
 
 
To Resolve this for a period of Time, reconfigure sqv, copy /usr/share/apt/default-sequoia.config to /etc/crypto-policies/back-ends/apt-sequoia.config, and change the date from 2026.02.01 to 2026.06.01 in the line  
 

Quote

[hash_algorithms] 
sha1.second_preimage_resistance = 2026-06-01    # Extend the expiry for legacy repositories 

the Repo should Update again until 2026.06.01, better Solution would be an updated signing Key. Edited ... by guest34875

[airxirtir 0]

Thanks for sharing.

This workaround helped on my system too. I’ll use it temporarily, but a proper fix would be an updated/reissued repo signing key (no SHA1).

Any update from the maintainers?