Warning: OpenPGP signature verification failed: http://linux.dropbox.com/debian trixie Release: The following signatures were invalid: BADSIG FC918B335044912E Dropbox Automatic Signing Key <linux@dropbox.com> Error: The package repository 'http://linux.dropbox.com/debian trixie Release' is not signed. please add new key to: https://linux.dropboxstatic.com/debian/dists/trixie/

I am having the same issues. I would rather stop using the dropbox app than stop using Debian.

"I'm afraid that if the minimum system requirements are not met, issues like this are kind of expected."That is a disjoint reply. Are you saying that accepting obsolete SHA1 signatures is a "minimum system requirement"?

I don't have neither Ubuntu, nor Fedora (as listed in the requirements) and no intentions of switching to either.I do have debian, on which Ubuntu is based, and I do have a much newer debian than what Ubuntu 18 is based on (debian 13 "trixie", the current debian stable, which was released on August 9 2025).The Dropbox debian package for Ubuntu has worked well for me on debian stable, since at least 2016, and still works.But I am currently getting daily nags from debian APT because the APT archive of the debian package is signed which SHA1, which is not considered secure anymore, and because of this debian APT (and possibly later Ubuntu APT as well...?) will start rejecting the archive in less than one year.So what you should do(and that you should do in any case...) is to upgrade the key used for signing your APT archive.I.e. no changes to the code, just a change to the archive (including resigning of the packages, I guess...?).

I am having the same issue, and I find the use of the SHA1 signatures very concerning in terms of trusting the security commitments of Dropbox. As a loyal customer who has been paying for Dropbox for twenty years or so, I hope this issue is given priority as a security concern.

I fully agree with the previous posters. While it is technically possible to relax the cryptographic policies of our platforms to keep using the Dropbox repository with its deprecated SHA-1 signature, Debian and other modern distributions are flagging said signatures as insecure for good reasons. This is quickly becoming a blocking problem for those who want to keep Dropbox integrated without compromising our system security.Having said that, we appreciate that this issue has been escalated internally, and we'd be very grateful if it could be prioritized so the repository is re-signed with a stronger algorithm, ensuring continued compatibility and security across all supported platforms.Thanks in advance.

OpenPGP signature verification failed with Debian Trixie.

24 Replies

Replies have been turned off for this discussion

Dell_Dropbox
Community Manager
1 month ago
Hello all,

A fix has been created for this issue and we expect the update to be pushed out by next week. Thanks to everyone for the patience you've shown, much appreciated!
Roesjka
New member | Level 2
2 months ago
I have the same issue as steinarb daves415 and slimy_asparagus. Running Debian Forky/Sid but it also happened on Trixie. Don't come to me about the minimum requirements as I exceed all the requirements mentioned.
Warning: https://linux.dropbox.com/debian/dists/sid/Release.gpg: Policy will reject signature within a year, see --audit for details.
slimy_asparagus
Helpful | Level 6
3 months ago
I have no interest in flatpak. And I think the work required would be more than fixing it for Debian. (I understand flatpak users may have a different perspective.)
If Dropbox stops working for me, I shall switch to a Dropbox competitor.
ObsidianR
Helpful | Level 5
3 months ago
Or they could go and validate their flatpak. That way we at least have something that works in all distros even if it's not optimal...
slimy_asparagus
Helpful | Level 6
3 months ago
Is anyone talking to the Ubuntu devs about this? Like at some point this will be in Ubuntu. Maybe it is already in a dev version. Dropbox should care about that even if they don't care about Debian directly.
ObsidianR
Helpful | Level 5
3 months ago
I did, it does not fix the issue for me.
To be fair, the error clearly states what the issue is and what the solution is too. It just needs to be changed to an up to date file format.
If this is not done soon, Dropbox will cease to function in all Debian-based distros, including Ubuntu which is listed as compatible in your documentation.
It is a genuinely simple fix if the dev team is notified.
daves415
Helpful | Level 6
3 months ago
Please understand that this situation currently affects all users of Debian Stable or newer.
There is a deadline, after which no updates will be accepted from the Dropbox repository.
This situation will very likely migrate to downstream Linux Distributions, including Ubuntu.
Jay
Dropbox Community Moderator
3 months ago
Hi ObsidianR, just to clarify, could you confirm that you've followed the previous steps in this thread in relation to removing and redownloading the package?
ObsidianR
Helpful | Level 5
3 months ago
This error persists, meaning we will lose Dropbox in Debian by February if it's not actioned...
daves415
Helpful | Level 6
4 months ago
The messaging in "sudo apt update --audit" indicates that Dropbox will be broken in Debian on February 1st 2026.