APT will consider Elastic repositories invalid soon

Elastic Stack Elasticsearch
1

Hi,

On Debian 13+, apt will soon consider Elastic repository invalid

Warning: https://artifacts.elastic.co/packages/8.x/apt/dists/stable/InRelease: Policy will reject signature within a year, see --audit for details
      because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
      because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

It seems that something should be done quite soon to prevent breakage.

I’ve searched for a GitHub repository to report this more formally, but it doesn’t seem specially related to either of the stack components and I didn’t find a suitable repository.

1 Like
2

This is related to this Sequoia policy config :

1 Like
3

Has there been any hint of any intention of fixing this?

4

As far as I can tell there's no problem here.

The InRelease file has:

  • Package signatures in MD5, SHA1 and SHA256
  • Hash: SHA512
  • An amored GPG signature using RSA + SHA256

It looks to me like the warning is incorrect or out of date.
That said, I don't manage the APT repo, so perhaps I missed something. Please let us know if there's something concrete you can point to.

5

I think you’re right. This is now correct.

1 Like