starred/ntfy

Fork 0

mirror of https://github.com/binwiederhier/ntfy.git synced 2026-05-09 16:35:53 +02:00

[GH-ISSUE #1357] Policy will reject signature within a year, see --audit for details #957

New issue

Closed

opened 2026-05-07 00:29:06 +02:00 by BreizhHardware · 9 comments

BreizhHardware commented

2026-05-07 00:29:06 +02:00

Owner

Originally created by @skibbipl on GitHub (May 30, 2025).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1357

💡 Idea
New debian apt tightened security for package repositories, current key for https://archive.heckel.io/apt/dists/debian/InRelease will be rejected next year.

Warning: https://archive.heckel.io/apt/dists/debian/InRelease: Policy will reject signature within a year, see --audit for details
Audit: https://archive.heckel.io/apt/dists/debian/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
   Signing key on CF871F1E8399DAEF470832661D5B8EDFB2476E53 is not bound:
              No binding signature at time 2025-05-30T00:37:18Z
     because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
     because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

💻 Target components
ntfy debian repository https://archive.heckel.io/apt/dists/debian/InRelease

Originally created by @skibbipl on GitHub (May 30, 2025). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1357  :bulb: **Idea** New debian apt tightened security for package repositories, current key for https://archive.heckel.io/apt/dists/debian/InRelease will be rejected next year. ``` Warning: https://archive.heckel.io/apt/dists/debian/InRelease: Policy will reject signature within a year, see --audit for details Audit: https://archive.heckel.io/apt/dists/debian/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CF871F1E8399DAEF470832661D5B8EDFB2476E53 is not bound: No binding signature at time 2025-05-30T00:37:18Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z ``` :computer: **Target components** ntfy debian repository https://archive.heckel.io/apt/dists/debian/InRelease

BreizhHardware

2026-05-07 00:29:06 +02:00

closed this issue
added the
enhancement
label

BreizhHardware commented

2026-05-07 00:29:06 +02:00

Author

Owner

@binwiederhier commented on GitHub (May 30, 2025):

Thanks. I may just have to move to a new repo anyway.

@binwiederhier commented on GitHub (May 30, 2025): Thanks. I may just have to move to a new repo anyway.

BreizhHardware commented

2026-05-07 00:29:06 +02:00

Author

Owner

@skibbipl commented on GitHub (May 30, 2025):

Recently debian maintainers packaged ntfy, however they have some issues packaging GUI part of ntfy. Perhaps you could cooperate with them to properly package ntfy in default debian repo?

@skibbipl commented on GitHub (May 30, 2025): Recently debian maintainers packaged [ntfy](https://packages.debian.org/sid/ntfy), however they have some issues packaging GUI part of ntfy. Perhaps you could cooperate with them to properly package ntfy in default debian repo?

BreizhHardware commented

2026-05-07 00:29:06 +02:00

Author

Owner

@binwiederhier commented on GitHub (May 30, 2025):

I offered my help yesterday in #1258. I wasn't aware about the GUI issues. I just found this though: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098866; I created these issues:

/cc @thekhalifa

@binwiederhier commented on GitHub (May 30, 2025): I offered my help yesterday in #1258. I wasn't aware about the GUI issues. I just found this though: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098866; I created these issues: - https://github.com/binwiederhier/ntfy/issues/1358 - https://github.com/binwiederhier/ntfy/issues/1359 /cc @thekhalifa

BreizhHardware commented

2026-05-07 00:29:07 +02:00

Author

Owner

@skibbipl commented on GitHub (May 30, 2025):

That's my BR 😄 It would be sweet to have properly packaged ntfy in debian repo ❤

@skibbipl commented on GitHub (May 30, 2025): That's my BR 😄 It would be sweet to have properly packaged ntfy in debian repo ❤

BreizhHardware commented

2026-05-07 00:29:07 +02:00

Author

Owner

@Offerel commented on GitHub (Aug 18, 2025):

As a workaround, I can manually install ntfy via dpkg. Enabling the Third-Party Repo seems to work. Also when i extend the SHA1 Key in debian config (/usr/share/apt/default-sequoia.config), i cant list the third-party repo with apt-cache showpkg ntfy. This only lists the Debian own repo.

Is there some way to use the third-party repo, in favor of the debian repo?

@Offerel commented on GitHub (Aug 18, 2025): As a workaround, I can manually install ntfy via dpkg. Enabling the Third-Party Repo seems to work. Also when i extend the SHA1 Key in debian config (/usr/share/apt/default-sequoia.config), i cant list the third-party repo with `apt-cache showpkg ntfy`. This only lists the Debian own repo. Is there some way to use the third-party repo, in favor of the debian repo?

BreizhHardware commented

2026-05-07 00:29:07 +02:00

Author

Owner

@jniggemann commented on GitHub (Aug 31, 2025):

Underlying cause

Internally, apt uses "Sequoia PGP" to verify signatures - hence the message that /usr/bin/sqv returnes an error code in your example above. By default, sqv is configured to accept the (old and broken) SHA1 hash algorithm only until Feb 1st 2026.

How to resolve this issue

There's nothing you can do besides raising awareness for this issue.
This issue can only be resolved by the project team, who need to change their repo signing key to one that does not use SHA1.

How to temporarily suppress this warning until this repo uses another key

To reconfigure sqv, copy /usr/share/apt/default-sequoia.config to /etc/crypto-policies/back-ends/apt-sequoia.config, and change the date in the last line from 2026-02-01 to ex. 2027-02-01. (more)

Please think about possible implications and do not forget to revert this, once the project team has switched to another key.

@jniggemann commented on GitHub (Aug 31, 2025): ## Underlying cause Internally, apt uses "Sequoia PGP" to verify signatures - hence the message that `/usr/bin/sqv` returnes an error code in your example above. By default, sqv is configured to accept the (old and broken) SHA1 hash algorithm only until Feb 1st 2026. ## How to resolve this issue There's nothing you can do besides raising awareness for this issue. This issue can only be resolved by the project team, who need to change their repo signing key to one that does not use SHA1. ## How to temporarily suppress this warning until this repo uses another key To reconfigure `sqv`, copy `/usr/share/apt/default-sequoia.config` to `/etc/crypto-policies/back-ends/apt-sequoia.config`, and change the date in the last line from 2026-02-01 to ex. 2027-02-01. ([more](https://book.sequoia-pgp.org/configuration.html)) Please think about possible implications and do not forget to revert this, once the project team has switched to another key.

BreizhHardware commented

2026-05-07 00:29:07 +02:00

Author

Owner

@binwiederhier commented on GitHub (Sep 23, 2025):

WIP: https://github.com/binwiederhier/ntfy-ansible/pull/5/files

Can be tried out here: https://archive.ntfy.sh/apt/ (test server, will be replaced)

@binwiederhier commented on GitHub (Sep 23, 2025): WIP: https://github.com/binwiederhier/ntfy-ansible/pull/5/files Can be tried out here: https://archive.ntfy.sh/apt/ (test server, will be replaced)

BreizhHardware commented

2026-05-07 00:29:07 +02:00

Author

Owner

@binwiederhier commented on GitHub (Sep 24, 2025):

Done

@binwiederhier commented on GitHub (Sep 24, 2025): Done - https://github.com/binwiederhier/ntfy-ansible/pull/5 - https://archive.ntfy.sh/apt/ - https://docs.ntfy.sh/install/#debianubuntu-repository

BreizhHardware commented

2026-05-07 00:29:07 +02:00

Author

Owner

@skibbipl commented on GitHub (Sep 24, 2025):

@binwiederhier I would also update the documentation with:

Convert debian sources to deb822 format. It is used in trixie.
apt-transport-https it's a transitional package and not needed anymore, apt already supports https.

Also everything works as expected.

@skibbipl commented on GitHub (Sep 24, 2025): @binwiederhier I would also update the documentation with: 1. Convert debian sources to [deb822](https://repolib.readthedocs.io/en/latest/deb822-format.html) format. It is used in trixie. 2. `apt-transport-https` it's a transitional package and not needed anymore, apt already supports https. Also everything works as expected.