W: https://packages.cisofy.com/community/lynis/deb/dists/stable/InRelease: Policy will reject signature within a year, see --audit for details

[kimariterikishi]

Describe the bug

LANG=C sudo apt-get update
[...]
Reading package lists... Done
W: https://packages.cisofy.com/community/lynis/deb/dists/stable/InRelease: Policy will reject signature within a year, see --audit for details

and (Debian 13 with Sequoia-PGP)

sq inspect /usr/share/keyrings/cisofy-software-public.gpg
/usr/share/keyrings/cisofy-software-public.gpg: OpenPGP Certificate.

      Fingerprint: 84FAA9983B24AEF24D6C87F1FEBB7D1812576482
                   Invalid: No binding signature at time 2025-08-17T12:11:59Z: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance, because SHA1 is not considered secure since 2023-02-01T00:00:00Z
  Public-key algo: RSA
  Public-key size: 4096 bits
    Creation time: 2021-06-22 05:36:13 UTC

           Subkey: 013BAA07180C50A7101097EF9DE922F1C2FDE6C4
                   Invalid: Policy rejected non-revocation signature (SubkeyBinding) requiring second pre-image resistance
                   because: SHA1 is not considered secure since 2023-02-01T00:00:00Z
                   Invalid: primary key: No binding signature at time 2025-08-17T12:11:59Z, because Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance, because SHA1 is not considered secure since 2023-02-01T00:00:00Z
  Public-key algo: RSA
  Public-key size: 4096 bits
    Creation time: 2021-06-22 05:37:49 UTC

           Subkey: 5B9AFED133C48A9880462C2336D5B047478863C2
                   Invalid: Policy rejected non-revocation signature (SubkeyBinding) requiring second pre-image resistance
                   because: SHA1 is not considered secure since 2023-02-01T00:00:00Z
                   Invalid: primary key: No binding signature at time 2025-08-17T12:11:59Z, because Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance, because SHA1 is not considered secure since 2023-02-01T00:00:00Z
  Public-key algo: RSA
  Public-key size: 4096 bits
    Creation time: 2021-06-22 05:36:13 UTC

           UserID: CISOfy software signing <software@cisofy.com>
                   Invalid: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
                   because: SHA1 is not considered secure since 2023-02-01T00:00:00Z

and

LANG=C sudo apt update --audit
[...]
Warning: https://packages.cisofy.com/community/lynis/deb/dists/stable/InRelease: Policy will reject signature within a year, see --audit for details
Audit: https://packages.cisofy.com/community/lynis/deb/dists/stable/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
   Signing key on 84FAA9983B24AEF24D6C87F1FEBB7D1812576482 is not bound:
              primary key
     because: No binding signature at time 2025-07-29T07:30:25Z
     because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
     because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

Version

• Distribution

lsb_release -a
No LSB modules are available.
Distributor ID:	Debian
Description:	Debian GNU/Linux 13 (trixie)
Release:	13
Codename:	trixie

• Lynis version

sudo lynis show version
3.1.5

Expected behavior

I try „gpg dearmor”, and „sq packet dearmor” and try .list or sources format, the warning does not disappear

*.list

deb [arch=amd64,arm64 signed-by=/usr/share/keyrings/cisofy-software-public.gpg] https://packages.cisofy.com/community/lynis/deb/ stable main

*.sources

URIs: https://packages.cisofy.com/community/lynis/deb/
Suites: stable
Architectures: amd64 arm64
Components: main
Types: deb
Suites: stable
Signed-By: /usr/share/keyrings/cisofy-software-public.gpg

Output

The log is not relevant to this problem.

Additional context

That's all, I've said everything.

[mboelen]

Thanks for reporting. A change has been made to our build process to switch the checksum to sha512. When the next release of Lynis is available, then we hope the change is properly signing all parts of the repository to fully resolve this.

We have not a specific date planned, but want to release 3.1.6 soon.

[mboelen]

Looks like an additional step is required, which is a change to the key itself. It looks similar to issue #1638

So we will also look into that key (we use two different keys due to backwards compatibility)

[kimariterikishi]

Thanks for reporting. A change has been made to our build process to switch the checksum to sha512. When the next release of Lynis is available, then we hope the change is properly signing all parts of the repository to fully resolve this.

We have not a specific date planned, but want to release 3.1.6 soon.

SHA512 is already sufficiently strong and also resolves the warning that appears. We are waiting for version 3.1.6; it's good that a new one is coming.

[kimariterikishi]

Looks like an additional step is required, which is a change to the key itself. It looks similar to issue #1638

So we will also look into that key (we use two different keys due to backwards compatibility)

Debian, and presumably other Linux systems, use the Sequoia-PGP method... for example, RHEL / Rocky, which you mentioned in your link.

Best regards

[BillTheGoat]

Will we need to manually update by downloading new keys, or can apt upgrade existing keys automatically?

[kimariterikishi]

Will we need to manually update by downloading new keys, or can apt upgrade existing keys automatically?

It is expected that the developers (here) will find a solution to avoid this: they will find a way to update the key in the next release.

After all, this is currently the only feature available for the packages:

Suites: stable

If they make another one available for “newer” Linux systems using the Sequoia-PGP method, for example

Suites: stable_sq

then you rewrite the mirror, download the new key, and you don't have to do anything else, but this way new users can also be sure they are making the right choice if the installation description includes which package to use for which Linux release. Obviously, there are 1001 other solutions. Let's wait for the new version of Lynis. ... meaning that all of this can be automated. The installer checks which system it is being installed on and replaces the key accordingly, if necessary.

[mboelen]

We expect that everything stays the same, as most likely key rotation (a new key) is NOT needed, but we need to alter the key so that it has the checksum algorithm.

When we know more, we will publish the details, including on the repository pages.

[kimariterikishi]

We expect that everything stays the same, as most likely key rotation (a new key) is NOT needed, but we need to alter the key so that it has the checksum algorithm.

When we know more, we will publish the details, including on the repository pages.

Great!

[mboelen]

Work is done on the key used to sign RPMs, as reported in #1638

What we know now is that the public key does change, so an action is required after all. On the package repository we have updated the page to share the updates.

Currently we are awaiting feedback. If all is well, then the other keys will be updated as well.

[BillTheGoat]

While doing this update, could you consider distributing deb repo info via Debian External Repositories. This is their preferred way of distributing repos, to avoid people running random repo install scripts. It's a very fast process and would only require updates when keys are changed.

[mboelen]

While doing this update, could you consider distributing deb repo info via Debian External Repositories. This is their preferred way of distributing repos, to avoid people running random repo install scripts. It's a very fast process and would only require updates when keys are changed.

Thanks for the suggestion @BillTheGoat - As this is a feature request and not directly part of the reported issue, please create a separate issue for it. Or better, a pull request to the extrepo-data project to include Lynis.