apt warning: Policy will reject signature within a year

[jaredledvina]

After configuring the Ubuntu Noble PPA endpoint as outlined in https://docs.ansible.com/ansible/latest/installation_guide/installation_distros.html#installing-ansible-on-debian but with a Deb822 formatted apt configured, I'm seeing the following warning when running apt update --audit:

Warning: http://ppa.launchpad.net/ansible/ansible/ubuntu/dists/noble/InRelease: Policy will reject signature within a year, see --audit for details
Audit: http://ppa.launchpad.net/ansible/ansible/ubuntu/dists/noble/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
   Signing key on 6125E2A8C77F2818FB7BD15B93C4A3FD7BB9C367 is not bound:
              No binding signature at time 2025-08-13T17:15:37Z
     because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
     because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

# cat /etc/apt/sources.list.d/ansible.sources
Types: deb
URIs: http://ppa.launchpad.net/ansible/ansible/ubuntu
Suites: noble
Components: main
Signed-By: /usr/share/keyrings/ansible-archive-keyring.gpg
# gpg --no-default-keyring --keyring /usr/share/keyrings/ansible-archive-keyring.gpg --list-keys
/usr/share/keyrings/ansible-archive-keyring.gpg
-----------------------------------------------
pub   rsa4096 2014-06-10 [SC]
      6125E2A8C77F2818FB7BD15B93C4A3FD7BB9C367
uid           [ unknown] Launchpad PPA for Ansible, Inc.

[slfbovey]

Same on newer Debian 13

[jniggemann]

Underlying cause

Internally, apt uses "Sequoia PGP" to verify signatures - hence the message that /usr/bin/sqv returnes an error code in your example above. By default, sqv is configured to accept the (old and broken) SHA1 hash algorithm only until Feb 1st 2026.

How to resolve this issue

There's nothing you can do besides raising awareness for this issue.
This issue can only be resolved by the project team, who need to change their repo signing key to one that does not use SHA1.

How to temporarily suppress this warning until this repo uses another key

To reconfigure sqv, copy /usr/share/apt/default-sequoia.config to /etc/crypto-policies/back-ends/apt-sequoia.config, and change the date in the last line from 2026-02-01 to ex. 2027-02-01. (more)

Please think about possible implications and do not forget to revert this, once the project team has switched to another key.