# Issues with sha1 cypher of packages
**URL:** https://discourse.orthanc-server.org/t/issues-with-sha1-cypher-of-packages/6375
**Category:** General
**Created:** [January 16, 2026, 2:45pm UTC](https://discourse.orthanc-server.org/t/issues-with-sha1-cypher-of-packages/6375 "2026-01-16T14:45:23Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Alex\_Vergara](https://discourse.orthanc-server.org/u/Alex_Vergara)
#### Post date: [January 16, 2026, 2:45pm UTC](https://discourse.orthanc-server.org/t/issues-with-sha1-cypher-of-packages/6375/1 "2026-01-16T14:45:23Z")
I got this error today
---
### Author:  [@jodogne](https://discourse.orthanc-server.org/u/jodogne)
#### Post date: [January 22, 2026, 5:20pm UTC](https://discourse.orthanc-server.org/t/issues-with-sha1-cypher-of-packages/6375/2 "2026-01-22T17:20:55Z")
**Hello,**
Thanks for the notification. The `debian.orthanc-labs.com` server is currently in the process of being migrated to a more recent server hosted on the UCLouvain infrastructure, which will solve this security warning. I’ll keep you updated.
**Regards,**
Sébastien-
---
### Author:  [@jodogne](https://discourse.orthanc-server.org/u/jodogne)
#### Post date: [January 23, 2026, 2:52pm UTC](https://discourse.orthanc-server.org/t/issues-with-sha1-cypher-of-packages/6375/3 "2026-01-23T14:52:50Z")
Hello,
The Debian repository has just been moved from `https://debian.orthanc-labs.com/` to `https://orthanc.uclouvain.be/debian/`, which uses a more recent HTTPS certificate. The instructions in the Orthanc Book have also been [updated with this new location](https://orthanc.uclouvain.be/book/users/cookbook.html#custom-debian-ubuntu-repository).
Please could you give a try?
Kind Regards,
Sébastien-
---
### Author:  [@Alex\_Vergara](https://discourse.orthanc-server.org/u/Alex_Vergara)
#### Post date: [March 4, 2026, 9:24am UTC](https://discourse.orthanc-server.org/t/issues-with-sha1-cypher-of-packages/6375/4 "2026-03-04T09:24:38Z")
Please apt-key was deprecated and removed [How To: 'apt-key' is deprecated, here's how to fix it - Debian - LearnLinuxTV Community](https://community.learnlinux.tv/t/how-to-apt-key-is-deprecated-heres-how-to-fix-it/489)
The instruction should be `wget -qO - ``https://orthanc.uclouvain.be/debian/archive.key`` | sudo gpg --dearmor -o /usr/share/keyrings/orthanc-archive-keyring.gpg`
Even after I generated the signature I get
```auto
Réception de : 6 https://orthanc.uclouvain.be/debian trixie InRelease [1 846 B]
Err : 6 https://orthanc.uclouvain.be/debian trixie InRelease
Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 93BE9F197ED5D0C30E593D8BA776582B312AC35D is not bound: No binding signature at time 2026-01-28T13:39:43Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Attention : OpenPGP signature verification failed: https://orthanc.uclouvain.be/debian trixie InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 93BE9F197ED5D0C30E593D8BA776582B312AC35D is not bound: No binding signature at time 2026-01-28T13:39:43Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Erreur : Le dépôt https://orthanc.uclouvain.be/debian trixie InRelease n'est pas signé.
Notification : Les mises à jour depuis un tel dépôt ne peuvent s'effectuer de manière sécurisée, et sont donc désactivées par défaut.
Notification : Voir les pages de manuel d'apt-secure(8) pour la création des dépôts et les détails de configuration d'un utilisateur.
```
---
### Author:  [@jodogne](https://discourse.orthanc-server.org/u/jodogne)
#### Post date: [March 30, 2026, 4:17pm UTC](https://discourse.orthanc-server.org/t/issues-with-sha1-cypher-of-packages/6375/5 "2026-03-30T16:17:37Z")
Hello,
> [@Alex\_Vergara](#):
>
> Please apt-key was deprecated and removed
The instructions I provided above explicitly referred to Debian 9, at a time when `apt-key` was still the proper tool. Please note that `apt-key` remained available until Debian 12, although it has been deprecated since Debian 11.
> [@Alex\_Vergara](#):
>
> Even after I generated the signature I get
Regarding Debian 13, I have replaced the digest algorithm used by the custom repository with SHA-512, which resolves the error you reported that resulted from Debian’s recent rejection of SHA-1. I have also added [instructions for using the custom repository on Debian 13 in the Orthanc Book](https://orthanc.uclouvain.be/book/users/cookbook.html#custom-debian-ubuntu-repository).
I hope everything is now working correctly.
Kind Regards,
Sébastien-