This question already has an answer here:

A recent update of apt (in Debian unstable) generates an warning message for repositories SHA1 signed. I get the idea you should privilege SHA2 signed repositories but I use some softwares which does not offer yet SHA2 signature and I still want to be able to upgrade my computer with one command apt-get update && apt-get dist-upgrade (which is stopped by SHA1 warning message).

I'm wondering how to get rid of this blocking warning message?

The warning message is: The repository is insufficiently signed

sources.list :

## Debian unstable - dépôts officiels

deb http://ftp.fr.debian.org/debian/ unstable main contrib non-free
deb-src http://ftp.fr.debian.org/debian/ unstable main contrib non-free

## Debian testing - dépôts officiels

deb http://ftp.fr.debian.org/debian/ testing main contrib non-free

deb http://security.debian.org/ testing/updates main contrib non-free

## Debian stable - dépôts officiels

deb http://ftp.fr.debian.org/debian/ stable main contrib non-free
deb http://ftp.fr.debian.org/debian/ stable-updates main contrib non-free

deb http://security.debian.org/ stable/updates main contrib non-free

# samsung printer
deb http://www.bchemnet.com/suldr/ debian extra
# Deb-multimedia
deb http://www.deb-multimedia.org sid main non-free
# SpiderOakONE
deb http://apt.spideroak.com/debian/ stable non-free

Blocking message on update:

# apt-get update
Hit:1 http://ftp.fr.debian.org/debian unstable InRelease
Hit:2 http://www.deb-multimedia.org sid InRelease                                                                                  
Hit:3 http://ftp.fr.debian.org/debian testing InRelease                                                                            
Hit:4 http://security.debian.org testing/updates InRelease                                                                         
Ign:5 http://ftp.fr.debian.org/debian stable InRelease                                                                           
Hit:6 http://security.debian.org stable/updates InRelease                                                                          
Hit:7 http://ftp.fr.debian.org/debian stable-updates InRelease                                                                     
Hit:8 http://ftp.fr.debian.org/debian stable Release                                                                               
Ign:9 http://download.opensuse.org/repositories/home:/selmf/Debian_8.0  InRelease                                                      
Hit:10 http://www.bchemnet.com/suldr debian InRelease                                                                         
Hit:11 http://download.opensuse.org/repositories/home:/selmf/Debian_8.0  Release            
Ign:12 http://apt.spideroak.com/debian stable InRelease                                         
Get:13 http://apt.spideroak.com/debian stable Release [1 025 B]
Get:15 http://apt.spideroak.com/debian stable Release.gpg [189 B]
Fetched 1 214 B in 0s (1 628 B/s)                        
Reading package lists... Done
W: gpgv:/var/lib/apt/lists/www.bchemnet.com_suldr_dists_debian_InRelease: The repository is insufficiently signed by key 52C1D92CE6FC35F636B045C3C95104E509BAC46D (weak digest)
W: gpgv:/var/lib/apt/lists/download.opensuse.org_repositories_home:_selmf_Debian%5f8.0_Release.gpg: The repository is insufficiently signed by key 69CD0BB29BCA799AB242B1723F3411BE43F8BC1F (weak digest)
W: gpgv:/var/lib/apt/lists/partial/apt.spideroak.com_debian_dists_stable_Release.gpg: The repository is insufficiently signed by key FE45E5330B11DCF03247EF49A6FF22FF08C15DD0 (weak digest)
W: Failed to fetch http://apt.spideroak.com/debian/dists/stable/Release  No Hash entry in Release file /var/lib/apt/lists/partial/apt.spideroak.com_debian_dists_stable_Release, which is considered strong enough for security purposes
E: Some index files failed to download. They have been ignored, or old ones used instead.

marked as duplicate by Wouter Verhelst, slm Jun 26 '16 at 14:43

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 1
    When you ask for help on an English site, please post error messages in English (run LC_MESSAGES=C your_command). People recognize English messages and can check them on their machine, and they are more searchable. – Gilles Mar 28 '16 at 21:30
  • I will comment since this is not an answer: I was on the Ubuntu IRC, and they say there doesn't seem to be a way, just have to wait for the repo maintainers to upgrade. Here is a link to the Debian wiki of the tracked repos that have not upgraded: wiki.debian.org/Teams/Apt/Sha1Removal – Daniel Toebe Apr 13 '16 at 15:48

The repository is signed using SHA1 hash which is no longer suported by APT.

I don't know how to fix that other than downgrading apt to stable version.


That warnings meand that the sign of the repos are not correct, you have to import them again.

If the repo have a url to download try this:

wget -qO - http://deb.opera.com/archive.key | sudo apt-key add -


sudo apt-key adv --keyserver <keyserver.ubuntu.com> --recv-keys <key id>
  • No it means the repo is signed using SHA1 and not SHA2. Re-importing the keys don't change anything. – ppr Mar 29 '16 at 11:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.