OpenPGP signature verification failed with Debian Trixie.

I get this message once a day after upgrading to debian 13 "trixie" on August 12 2025.

W: http://linux.dropbox.com/debian/dists/sid/Release.gpg: Policy will reject signature within a year, see --audit for details

The relevant output from "apt update --policy", is:

Warning: http://linux.dropbox.com/debian/dists/sid/Release.gpg: Policy will reject signature within a year, see --audit for details
Audit: http://linux.dropbox.com/debian/dists/sid/Release.gpg: Sub-process /usr/bin/sqv returned an error code (1), error message is:
   Signing key on 1C61A2656FB57B7E4DE0F4C1FC918B335044912E is not bound:
              No binding signature at time 2020-03-04T23:26:35Z
     because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
     because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

Looks like you're signing with SHA1 and that will be forbidden by debian APT policy in a year from now.

Hey maurom, thank you so much for the heads up! 

Your info here will be valuable, and helpful for other users facing the same thing, and hopefully will also resolve Verwijs issue too.

In any case, I'll be one post away! 

Hi Verwijs and Megan. I got the same error on a Debian Bookworm system when running `apt update`:

W: GPG error: http://linux.dropbox.com/debian bookworm Release: The following signatures were invalid: BADSIG FC918B335044912E Dropbox Automatic Signing Key <linux@dropbox.com>
E: The repository 'http://linux.dropbox.com/debian bookworm Release' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Strangely enough, downloading and verifying the signature works fine (the downloaded public key is the same I had in my system keyring):

$ echo "Fetch latest release and signature"
$ wget -nv https://linux.dropboxstatic.com/debian/dists/bookworm/Release{,.gpg}
2025-06-04 09:58:45 URL:https://linux.dropboxstatic.com/debian/dists/bookworm/Release [6606/6606] -> "Release" [1]
2025-06-04 09:58:45 URL:https://linux.dropboxstatic.com/debian/dists/bookworm/Release.gpg [488/488] -> "Release.gpg" [1]
FINISHED --2025-06-04 09:58:45--
Total wall clock time: 1.0s
Downloaded: 2 files, 6.9K in 0s (51.8 MB/s)

$ echo "Fetch Dropbox repository public key"
$ wget -nv https://linux.dropbox.com/fedora/rpm-public-key.asc
2025-06-04 10:56:47 URL:https://linux.dropbox.com/fedora/rpm-public-key.asc [975/975] -> "rpm-public-key.asc" [1]

$ echo "Import the public key into a temporary keyring"
$ gpg --no-default-keyring --keyring dropbox-temp.kbx --trust-model always --import rpm-public-key.asc
gpg: key FC918B335044912E: public key "Dropbox Automatic Signing Key <linux@dropbox.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

$ echo "Verify the release file signature"
$ gpg --no-default-keyring --keyring dropbox-temp.kbx --verify Release.gpg Release
gpg: Signature made Fri 30 May 2025 04:08:45 PM -03
gpg:                using RSA key 1C61A2656FB57B7E4DE0F4C1FC918B335044912E
gpg: Good signature from "Dropbox Automatic Signing Key <linux@dropbox.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 1C61 A265 6FB5 7B7E 4DE0  F4C1 FC91 8B33 5044 912E

In my case, it seems the locally cached metadata for the Dropbox repo was stale, so I removed the files listed by this command.

$ find /var/lib/apt/lists -iname "linux.dropbox.com*"
/var/lib/apt/lists/linux.dropbox.com_debian_dists_bookworm_Release.gpg
/var/lib/apt/lists/linux.dropbox.com_debian_dists_bookworm_main_binary-amd64_Packages
/var/lib/apt/lists/linux.dropbox.com_debian_dists_bookworm_Release

This forced apt to re-download the Release, Release.gpg and the Packages file.
Afterward, `apt update` runs properly and without errors.

Hey Verwijs​, let's jump right into this! 

Just wanted to check with you, and ask if you're still getting the same message. 

Also, what steps do you follow on your end before seeing it? 

Keep me posted, and we'll take it from there!