# Ubuntu PPA key signature **URL:** \ **Category:** Get Help\ **Tags:** ubuntu\ **Created:** [February 1, 2026, 2:03pm UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237 "2026-02-01T14:03:21Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![ronaldslc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ronaldslc/32/10264_2.png) [@ronaldslc](https://forum.ansible.com/u/ronaldslc)\ **Post date:** [February 1, 2026, 2:03pm UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/1 "2026-02-01T14:03:21Z")
> **[Search results for '0x6125E2A8C77F2818FB7BD15B93C4A3FD7BB9C367'](https://keyserver.ubuntu.com/pks/lookup?fingerprint=on&op=index&search=0x6125E2A8C77F2818FB7BD15B93C4A3FD7BB9C367)** Signing key on 6125E2A8C77F2818FB7BD15B93C4A3FD7BB9C367 is not bound: No binding signature at time Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure Feb 1st 2026 is when SHA1 is considered insecure. Hitting this issue when trying to install Ansible on Debian 13. The installation guide is now out of date. > **[Installing Ansible on specific operating systems — Ansible Community...](https://docs.ansible.com/projects/ansible/latest/installation_guide/installation_distros.html)** ---
**Author:** ![chris](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chris/32/293_2.png) [@chris](https://forum.ansible.com/u/chris)\ **Post date:** [February 1, 2026, 7:37pm UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/2 "2026-02-01T19:37:18Z")
This blog post explains a work around that you could use prior to the GPG key(s) being updated: > **[Dealing with apt's warning 'Policy will reject signature within a year, see...](https://neilzone.co.uk/2026/01/dealing-with-apts-warning-policy-will-reject-signature-within-a-year-see---audit-for-details/)** > > I’ve noticed an increasing number of apt updates result in a warning that: ---
**Author:** ![felixfontein](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/felixfontein/32/7530_2.png) [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Post date:** [February 1, 2026, 9:58pm UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/3 "2026-02-01T21:58:28Z")
CC @deric.crago ---
**Author:** ![deric.crago](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/deric.crago/32/749_2.png) [@deric.crago](https://forum.ansible.com/u/deric.crago)\ **Post date:** [February 4, 2026, 12:24am UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/4 "2026-02-04T00:24:36Z")
Thanks for flagging this. I am looking into it and hope to resolve it before Monday. ---
**Author:** ![CLe1](https://avatars.discourse-cdn.com/v4/letter/c/e68b1a/32.png) [@CLe1](https://forum.ansible.com/u/CLe1)\ **Post date:** [February 16, 2026, 10:37am UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/5 "2026-02-16T10:37:34Z")
Hi! Has the key already been rotated? Thank you! Chris ---
**Author:** ![elnadrion](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/elnadrion/32/10358_2.png) [@elnadrion](https://forum.ansible.com/u/elnadrion)\ **Post date:** [February 16, 2026, 12:26pm UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/6 "2026-02-16T12:26:18Z")
Hey 🙂 @deric.crago any success fixing the issue? The error has been there for more than 2 weeks and still isn’t fixed. Atm it’s not possible to install Ansible via apt on Debian 13 following the official documentation 😕 ---
**Author:** ![wedwards](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wedwards/32/2545_2.png) [@wedwards](https://forum.ansible.com/u/wedwards)\ **Post date:** [February 17, 2026, 11:22am UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/7 "2026-02-17T11:22:42Z")
Same problem here. ---
**Author:** ![deric.crago](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/deric.crago/32/749_2.png) [@deric.crago](https://forum.ansible.com/u/deric.crago)\ **Post date:** [February 18, 2026, 11:58pm UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/8 "2026-02-18T23:58:33Z")
OpenPGP signing keys for Launchpad PPAs are managed entirely by Launchpad and as owners, we cannot override them. Since this PPA is designed for Ubuntu, Debian’s stricter `sqv` verification is rejecting signatures that work fine on Ubuntu. To resolve this compatibility issue on Debian, the only workaround I’m aware of is adding `trusted=yes`. I’ve opened a [PR](https://github.com/ansible/ansible-documentation/pull/3487) to update the documentation with this fix. Reviews and testing are welcome. ---
**Author:** ![chris](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/chris/32/293_2.png) [@chris](https://forum.ansible.com/u/chris)\ **Post date:** [February 19, 2026, 9:38am UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/9 "2026-02-19T09:38:48Z")
Rather than adding `trusted=yes` wouldn’t it be better to follow the [suggestion here](https://neilzone.co.uk/2026/01/dealing-with-apts-warning-policy-will-reject-signature-within-a-year-see---audit-for-details/)? > I think you’d be better off looking at the unfortunately lightly-documented /usr/share/apt/default-sequoia.config. You can copy that file to /etc/crypto-policies/back-ends/apt-sequoia.config as it suggests, and then tweak the dates as needed. The `/usr/share/apt/default-sequoia.config` file contains: ```ini # Default APT Sequoia configuration. To overwrite, consider copying this # to /etc/crypto-policies/back-ends/apt-sequoia.config and modify the # desired values. [asymmetric_algorithms] dsa2048 = 2024-02-01 dsa3072 = 2024-02-01 dsa4096 = 2024-02-01 brainpoolp256 = 2028-02-01 brainpoolp384 = 2028-02-01 brainpoolp512 = 2028-02-01 rsa2048 = 2030-02-01 [hash_algorithms] sha1.second_preimage_resistance = 2026-02-01 # Extend the expiry for legacy repositories sha224 = 2026-02-01 [packets] signature.v3 = 2026-02-01 # Extend the expiry ``` Also shouldn’t we be suggesting that people use [deb822](https://manpages.debian.org/bookworm/dpkg-dev/deb822.5.en.html) `.sources` files rather than `.list` files? ---
**Author:** ![deric.crago](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/deric.crago/32/749_2.png) [@deric.crago](https://forum.ansible.com/u/deric.crago)\ **Post date:** [February 19, 2026, 5:49pm UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/10 "2026-02-19T17:49:20Z")
Thanks for the ongoing discussion, everyone. While I don’t really like suggesting `trusted=yes` in the installation guide, that seems like a better suggestion to me than having people modify their global system configuration just for this one PPA. Changing the system config weakens security checks for every repository on the machine, whereas `trusted=yes` keeps the exception isolated to just this PPA. I’m open to other thoughts on this and perhaps we should make a note in the docs about how we came to whatever conclusion we decide. Also, as a quick update on the installation instructions themselves, I am going to update my PR to use the `deb822 .sources` format instead of traditional `.list` files. I originally held off on doing this because I tried using embedded keys, which failed on older versions of Debian like Bullseye. It didn’t occur to me at the time to just use an external key reference as before. ---
**Author:** ![lgwapnitsky](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lgwapnitsky/32/10388_2.png) [@lgwapnitsky](https://forum.ansible.com/u/lgwapnitsky)\ **Post date:** [February 22, 2026, 6:21pm UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/11 "2026-02-22T18:21:39Z")
Just making a note and checking for an update to this. Ran into the issue this morning ---
**Author:** ![deric.crago](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/deric.crago/32/749_2.png) [@deric.crago](https://forum.ansible.com/u/deric.crago)\ **Post date:** [March 5, 2026, 3:15am UTC](https://forum.ansible.com/t/ubuntu-ppa-key-signature/45237/12 "2026-03-05T03:15:08Z")
Hi everyone, To keep this discussion coordinated, I wanted to cross-link a few related threads where this is being tracked: - **GitHub Issue:** [ansible-community/ppa #114](https://github.com/ansible-community/ppa/issues/114) - **Documentation PR:** [ansible/ansible-documentation #3487](https://github.com/ansible/ansible-documentation/pull/3487) If you have any additional thoughts, technical edge cases, or ideas on the implementation, please consider adding them to those threads (especially the PR) so we can centralize the feedback. Thanks!