# APT will consider Elastic repositories invalid soon

**URL:** <https://discuss.elastic.co/t/apt-will-consider-elastic-repositories-invalid-soon/384448>\
**Category:** Elasticsearch\
**Created:** [January 9, 2026, 7:00am UTC](https://discuss.elastic.co/t/apt-will-consider-elastic-repositories-invalid-soon/384448 "2026-01-09T07:00:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jeremy\_Lecour](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeremy_lecour/32/1416_2.png) [@Jeremy\_Lecour](https://discuss.elastic.co/u/Jeremy_Lecour)\
**Post date:** [January 9, 2026, 7:00am UTC](https://discuss.elastic.co/t/apt-will-consider-elastic-repositories-invalid-soon/384448/1 "2026-01-09T07:00:59Z")

</div>

Hi,

On Debian 13+, `apt` will soon consider Elastic repository invalid

```auto
Warning: https://artifacts.elastic.co/packages/8.x/apt/dists/stable/InRelease: Policy will reject signature within a year, see --audit for details
      because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
      because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

```

It seems that something should be done quite soon to prevent breakage.

I’ve searched for a GitHub repository to report this more formally, but it doesn’t seem specially related to either of the stack components and I didn’t find a suitable repository.

---

<div class="post-metadata">

**Author:** ![Jeremy\_Lecour](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeremy_lecour/32/1416_2.png) [@Jeremy\_Lecour](https://discuss.elastic.co/u/Jeremy_Lecour)\
**Post date:** [January 9, 2026, 9:19am UTC](https://discuss.elastic.co/t/apt-will-consider-elastic-repositories-invalid-soon/384448/2 "2026-01-09T09:19:31Z")

</div>

This is related to this Sequoia policy config :

> **[sequoia\_policy\_config - Rust](https://docs.rs/sequoia-policy-config/latest/sequoia_policy_config/)**
>
> Configures a \`StandardPolicy\` using a configuration file.

---

<div class="post-metadata">

**Author:** ![taprove](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/taprove/32/146825_2.png) [@taprove](https://discuss.elastic.co/u/taprove)\
**Post date:** [February 6, 2026, 12:30am UTC](https://discuss.elastic.co/t/apt-will-consider-elastic-repositories-invalid-soon/384448/3 "2026-02-06T00:30:24Z")

</div>

Has there been any hint of any intention of fixing this?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [February 10, 2026, 4:18am UTC](https://discuss.elastic.co/t/apt-will-consider-elastic-repositories-invalid-soon/384448/4 "2026-02-10T04:18:44Z")

</div>

As far as I can tell there's no problem here.

The `InRelease` file has:

- Package signatures in MD5, SHA1 and SHA256
- `Hash: SHA512`
- An amored GPG signature using RSA + SHA256

It looks to me like the warning is incorrect or out of date.  
That said, I don't manage the APT repo, so perhaps I missed something. Please let us know if there's something concrete you can point to.

---

<div class="post-metadata">

**Author:** ![Jeremy\_Lecour](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeremy_lecour/32/1416_2.png) [@Jeremy\_Lecour](https://discuss.elastic.co/u/Jeremy_Lecour)\
**Post date:** [February 12, 2026, 8:57am UTC](https://discuss.elastic.co/t/apt-will-consider-elastic-repositories-invalid-soon/384448/5 "2026-02-12T08:57:44Z")

</div>

I think you’re right. This is now correct.