2

This question already has an answer here:

A recent update of apt (in Debian unstable) generates an warning message for repositories SHA1 signed. I get the idea you should privilege SHA2 signed repositories but I use some softwares which does not offer yet SHA2 signature and I still want to be able to upgrade my computer with one command apt-get update && apt-get dist-upgrade (which is stopped by SHA1 warning message).

I'm wondering how to get rid of this blocking warning message?

The warning message is: The repository is insufficiently signed

sources.list :

## Debian unstable - dépôts officiels

deb http://ftp.fr.debian.org/debian/ unstable main contrib non-free
deb-src http://ftp.fr.debian.org/debian/ unstable main contrib non-free

## Debian testing - dépôts officiels

deb http://ftp.fr.debian.org/debian/ testing main contrib non-free

deb http://security.debian.org/ testing/updates main contrib non-free

## Debian stable - dépôts officiels

deb http://ftp.fr.debian.org/debian/ stable main contrib non-free
deb http://ftp.fr.debian.org/debian/ stable-updates main contrib non-free

deb http://security.debian.org/ stable/updates main contrib non-free

#------
# samsung printer
deb http://www.bchemnet.com/suldr/ debian extra
# Deb-multimedia
deb http://www.deb-multimedia.org sid main non-free
# SpiderOakONE
deb http://apt.spideroak.com/debian/ stable non-free

Blocking message on update:

# apt-get update
Hit:1 http://ftp.fr.debian.org/debian unstable InRelease
Hit:2 http://www.deb-multimedia.org sid InRelease                                                                                  
Hit:3 http://ftp.fr.debian.org/debian testing InRelease                                                                            
Hit:4 http://security.debian.org testing/updates InRelease                                                                         
Ign:5 http://ftp.fr.debian.org/debian stable InRelease                                                                           
Hit:6 http://security.debian.org stable/updates InRelease                                                                          
Hit:7 http://ftp.fr.debian.org/debian stable-updates InRelease                                                                     
Hit:8 http://ftp.fr.debian.org/debian stable Release                                                                               
Ign:9 http://download.opensuse.org/repositories/home:/selmf/Debian_8.0  InRelease                                                      
Hit:10 http://www.bchemnet.com/suldr debian InRelease                                                                         
Hit:11 http://download.opensuse.org/repositories/home:/selmf/Debian_8.0  Release            
Ign:12 http://apt.spideroak.com/debian stable InRelease                                         
Get:13 http://apt.spideroak.com/debian stable Release [1 025 B]
Get:15 http://apt.spideroak.com/debian stable Release.gpg [189 B]
Fetched 1 214 B in 0s (1 628 B/s)                        
Reading package lists... Done
W: gpgv:/var/lib/apt/lists/www.bchemnet.com_suldr_dists_debian_InRelease: The repository is insufficiently signed by key 52C1D92CE6FC35F636B045C3C95104E509BAC46D (weak digest)
W: gpgv:/var/lib/apt/lists/download.opensuse.org_repositories_home:_selmf_Debian%5f8.0_Release.gpg: The repository is insufficiently signed by key 69CD0BB29BCA799AB242B1723F3411BE43F8BC1F (weak digest)
W: gpgv:/var/lib/apt/lists/partial/apt.spideroak.com_debian_dists_stable_Release.gpg: The repository is insufficiently signed by key FE45E5330B11DCF03247EF49A6FF22FF08C15DD0 (weak digest)
W: Failed to fetch http://apt.spideroak.com/debian/dists/stable/Release  No Hash entry in Release file /var/lib/apt/lists/partial/apt.spideroak.com_debian_dists_stable_Release, which is considered strong enough for security purposes
E: Some index files failed to download. They have been ignored, or old ones used instead.

marked as duplicate by Wouter Verhelst, slm Jun 26 '16 at 14:43

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    When you ask for help on an English site, please post error messages in English (run LC_MESSAGES=C your_command). People recognize English messages and can check them on their machine, and they are more searchable. – Gilles Mar 28 '16 at 21:30
  • I will comment since this is not an answer: I was on the Ubuntu IRC, and they say there doesn't seem to be a way, just have to wait for the repo maintainers to upgrade. Here is a link to the Debian wiki of the tracked repos that have not upgraded: wiki.debian.org/Teams/Apt/Sha1Removal – Daniel Toebe Apr 13 '16 at 15:48
1

The repository is signed using SHA1 hash which is no longer suported by APT.

I don't know how to fix that other than downgrading apt to stable version.

-1

That warnings meand that the sign of the repos are not correct, you have to import them again.

If the repo have a url to download try this:

wget -qO - http://deb.opera.com/archive.key | sudo apt-key add -

Or:

sudo apt-key adv --keyserver <keyserver.ubuntu.com> --recv-keys <key id>
  • No it means the repo is signed using SHA1 and not SHA2. Re-importing the keys don't change anything. – ppr Mar 29 '16 at 11:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.