Policy will reject signature

Plex Media Server
1

Server Version#: 1.42.2.10156

Good morning, when I go to perform the update, I get the following warning:
warning: https://downloads.plex.tv/repo/deb/dists/public/InRelease: Policy will reject signature within a year, see --audit for details

How can I fix the problem?

No LSB modules are available.
Distributor ID: Debian
Description: Debian GNU/Linux 13 (trixie)
Release: 13
Codename: trixie

3 Likes
2

Yes, I am waiting too, that Plex is fixing this. I think Debian will reject the key in early 2026, aka 2026-02-01.

Audit: https://downloads.plex.tv/repo/deb/dists/public/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
   Signing key on CD...9D is not bound:
              No binding signature at time 2025-09-22T18:33:03Z
     because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
     because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
1 Like
3

@ChuckPa Any chance you can get someone to answer this question?

4
1 Like
5

Not trying to be a nag but thats 67 days from today
 Not including any time off, so thats FAST approaching

1 Like
6

@dbirch

Good thing you’re not my wife :stuck_out_tongue: ROFL ROFL

There is a lot going on internally about this.

Prior to the certificates being updated, other work MUST be completed.

That’s the priority right now.

I know the cert is important but, compared to the other work, it’s trivial (create a certificate, publish the public part, start signing builds with it).

It will get done. Don’t worry. It might be a photo finish but it’ll make it

7

Debian 13.2 here. apt output:

Warning: https://downloads.plex.tv/repo/deb/dists/public/InRelease: Policy will reject signature within a year, see --audit for details
Audit: https://downloads.plex.tv/repo/deb/dists/public/InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is:
   Signing key on CD665CBA0E2F88B7373F7CB997203C7B3ADCA79D is not bound:
              No binding signature at time 2025-09-22T18:33:03Z
     because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
     because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
1 Like
8

same problem

1 Like
9

Same issue here:

looks like Debian 13 enforced no more SHA-1 on 01FEB2026

“SHA1 is not considered secure since 2026-02-01T00:00:00”

I think we need new GPG keys that are not SHA-1? is there an updated key yet?

Warning: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: ``https://downloads.plex.tv/repo/deb`` public InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CD665CBA0E2F88B7373F7CB997203C7B3ADCA79D is not bound: No binding signature at time 2025-09-22T18:33:03Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Warning: Failed to fetch ``https://downloads.plex.tv/repo/deb/dists/public/InRelease`` Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on CD665CBA0E2F88B7373F7CB997203C7B3ADCA79D is not bound: No binding signature at time 2025-09-22T18:33:03Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

3 Likes
10

Any update @ChuckPa?

Thank you

1 Like
11

I am out of that loop.

The build team and engineering are handling the construction of the new repo, putting the new GPG key (which is tested and works well with RPMs) out, and setting up a new DEB repo.

They will be doing the updated packages . I am no longer involved.

12

Any updates from the Plex team? Apt updates have been throwing warning messages for months. I am a bit surprised that this wasn’t addressed prior to 2/1/26, and even more shocked it has remained broken for multiple days.

Is there an ETA?

2 Likes
13

I agree this is shocking. There has been a warning for many months now, and promises that it was being addressed.

3 Likes
14

This is shockingly late for a trivial change,. all they needed to do was generate a new secret key with a safe algorithm for their repo and give us the gpg (public key) for it to replace our existing one.

7 Likes
15

Well well well
 I guess it is time to leave the ship :frowning:

2 Likes
16

Still waiting for an update. How has this taken this long, when plex has known about it for more than a year

“I am out of that loop.”

“I am no longer involved.”

Sounds like whoever is attempting to take over your job is incompetent.

1 Like
17

Plex Support, please advise how to fix this error?

Get:6 https://downloads.plex.tv/repo/deb public InRelease [6,685 B]
Err:6 https://downloads.plex.tv/repo/deb public InRelease
Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key 97203C7B3ADCA79D, which is needed to verify signature.
Warning: OpenPGP signature verification failed: https://downloads.plex.tv/repo/deb public InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Missing key 97203C7B3ADCA79D, which is needed to verify signature.
Error: The repository ‘https://downloads.plex.tv/repo/deb public InRelease’ is not signed.
Notice: Updating from such a repository can’t be done securely, and is therefore disabled by default.

18

The fix is in the other thread

1 Like
20

Good morning, today I received an email from Plex support with a link to an article on how to resolve the issue with repositories and the key, and by following the procedure, the problem is solved.
Below I leave the link to the article:

https://support.plex.tv/articles/235974187-enable-repository-updating-for-supported-linux-server-distributions/