Unable to verify any Release files since 3.10

Version

      "versions": {
        "deb": "3.10.0",
        "npm": "0.10.0",
        "rpm": "3.38.4",
        "core": "3.116.0",
        "file": "3.116.0",
        "maven": "0.25.1",
        "ostree": "2.6.1",
        "python": "3.34.0",
        "ansible": "0.30.0",
        "certguard": "3.116.0",
        "container": "2.29.0",
        "hugging_face": "0.3.2"
      }

Describe the bug
Since version 3.10 I have two remote repositories that are unable to sync due to verify. Under version 3.9 (Pulp 113) it was working.

Remote settings:

❯ pulp deb remote show --name apt-cache_nodesource-22
{
  "pulp_href": "/pulp/api/v3/remotes/deb/apt/019a3590-f5d0-7834-b971-ff02a2a67ced/",
  "prn": "prn:deb.aptremote:019a3590-f5d0-7834-b971-ff02a2a67ced",
  "pulp_created": "2025-10-30T14:41:23.921219Z",
  "pulp_last_updated": "2026-08-20T08:09:41.983040Z",
  "name": "apt-cache_nodesource-22",
  "url": "https://deb.nodesource.com/node_22.x/",
  "pulp_labels": {},
  "policy": "immediate",
  "hidden_fields": [
    {
      "name": "client_key",
      "is_set": false
    },
    {
      "name": "proxy_username",
      "is_set": false
    },
    {
      "name": "proxy_password",
      "is_set": false
    },
    {
      "name": "username",
      "is_set": false
    },
    {
      "name": "password",
      "is_set": false
    }
  ],
  "ca_cert": null,
  "client_cert": null,
  "tls_validation": true,
  "proxy_url": null,
  "max_retries": null,
  "total_timeout": null,
  "connect_timeout": null,
  "sock_connect_timeout": null,
  "sock_read_timeout": null,
  "headers": null,
  "download_concurrency": null,
  "rate_limit": null,
  "distributions": "nodistro",
  "components": "main",
  "architectures": "amd64 arm64",
  "sync_sources": false,
  "sync_udebs": false,
  "sync_installer": false,
  "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQENBFdDN1ABCADaNd/I3j3tn40deQNgz7hB2NvT+syXe6k4ZmdiEcOfBvFrkS8B\nhNS67t93etHsxEy7E0qwsZH32bKazMqe9zDwoa3aVImryjh6SHC9lMtW27JPHFeM\nSrkt9YmH1WMwWcRO6eSY9B3PpazquhnvbammLuUojXRIxkDroy6Fw4UKmUNSRr32\n9Ej87jRoR1B2/57Kfp2Y4+vFGGzSvh3AFQpBHq51qsNHALU6+8PjLfIt+5TPvaWR\nTB+kAZnQZkaIQM2nr1n3oj6ak2RATY/+kjLizgFWzgEfbCrbsyq68UoY5FPBnu4Z\nE3iDZpaIqwKr0seUC7iA1xM5eHi5kty1oB7HABEBAAG0Ik5Tb2xpZCA8bnNvbGlk\nLWdwZ0Bub2Rlc291cmNlLmNvbT6JATgEEwECACIFAldDN1ACGwMGCwkIBwMCBhUI\nAgkKCwQWAgMBAh4BAheAAAoJEC9ZtfmbG+C0y7wH/i4xnab36dtrYW7RZwL8i6Sc\nNjMx4j9+U1kr/F6YtqWd+JwCbBdar5zRghxPcYEq/qf7MbgAYcs1eSOuTOb7n7+o\nxUwdH2iCtHhKh3Jr2mRw1ks7BbFZPB5KmkxHaEBfLT4d+I91ZuUdPXJ+0SXs9gzk\nDbz65Uhoz3W03aiF8HeL5JNARZFMbHHNVL05U1sTGTCOtu+1c/33f3TulQ/XZ3Y4\nhwGCpLe0Tv7g7Lp3iLMZMWYPEa0a7S4u8he5IEJQLd8bE8jltcQvrdr3Fm8kI2Jg\nBJmUmX4PSfhuTCFaR/yeCt3UoW883bs9LfbTzIx9DJGpRIu8Y0IL3b4sj/GoZVq5\nAQ0EV0M3UAEIAKrTaC62ayzqOIPa7nS90BHHck4Z33a2tZF/uof38xNOiyWGhT8u\nJeFoTTHn5SQq5Ftyu4K3K2fbbpuu/APQF05AaljzVkDGNMW4pSkgOasdysj831cu\nssrHX2RYS22wg80k6C/Hwmh5F45faEuNxsV+bPx7oPUrt5n6GMx84vEP3i1+FDBi\n0pt/B/QnDFBXki1BGvJ35f5NwDefK8VaInxXP3ZN/WIbtn5dqxppkV/YkO7GiJlp\nJlju9rf3kKUIQzKQWxFsbCAPIHoWv7rH9RSxgDithXtG6Yg5R1aeBbJaPNXL9wpJ\nYBJbiMjkAFaz4B95FOqZm3r7oHugiCGsHX0AEQEAAYkBHwQYAQIACQUCV0M3UAIb\nDAAKCRAvWbX5mxvgtE/OB/0VN88DR3Y3fuqy7lq/dthkn7Dqm9YXdorZl3L152eE\nIF882aG8FE3qZdaLGjQO4oShAyNWmRfSGuoH0XERXAI9n0r8m4mDMxE6rtP7tHet\ny/5M8x3CTyuMgx5GLDaEUvBusnTD+/v/fBMwRK/cZ9du5PSG4R50rtst+oYyC2ao\nx4I2SgjtF/cY7bECsZDplzatN3gv34PkcdIg8SLHAVlL4N5tzumDeizRspcSyoy2\nK2+hwKU4C4+dekLLTg8rjnRROvplV2KtaEk6rxKtIRFDCoQng8wfJuIMrDNKvqZw\nFRGt7cbvW5MCnuH8MhItOl9Uxp1wHp6gtav/h8Gp6MBa\n=MARt\n-----END PGP PUBLIC KEY BLOCK-----",
  "ignore_missing_package_indices": false
}

Worker log:

2026-08-20T09:27:16.008562329+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulp_deb.app.tasks.synchronizing:WARNING: Your pulp instance is configured to prohibit use of the MD5 checksum algorithm!
2026-08-20T09:27:16.00858177+02:00 stderr F Processing MD5 IN ADDITION to a secure hash like SHA-256 is "highly recommended".
2026-08-20T09:27:16.00860263+02:00 stderr F See https://docs.pulpproject.org/pulp_deb/workflows/checksums.html for more info.
2026-08-20T09:27:16.00860588+02:00 stderr F 
2026-08-20T09:27:16.014222261+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulp_deb.app.tasks.synchronizing:INFO: Downloading Release file for distribution: "nodistro"
2026-08-20T09:27:17.221640019+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulp_deb.app.tasks.synchronizing:WARNING: Verification of InRelease failed. Removing it.
2026-08-20T09:27:17.256199407+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulp_deb.app.tasks.synchronizing:WARNING: Verification of Release + Release.gpg failed. Removing it.
2026-08-20T09:27:17.319542918+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulpcore.tasking.tasks:INFO: Task[pulp_deb.app.tasks.synchronizing.synchronize] 01a01e11-2750-7dce-9a4b-d3172db6f043 failed (NoValidSignatureForKey: [DEB0002] Unable to verify any Release files from 'https://deb.nodesource.com/node_22.x/Release' using the GPG key provided.) in domain: default
2026-08-20T09:27:17.320188005+02:00 stderr F pulp [6419a45dd1f34ff0b9e1e2da31f55b9a]: pulpcore.tasking.tasks:INFO:   File "/usr/local/lib/python3.11/site-packages/pulpcore/tasking/tasks.py", line 86, in _execute_task
2026-08-20T09:27:17.320194006+02:00 stderr F     result = task_function()
2026-08-20T09:27:17.320213126+02:00 stderr F              ^^^^^^^^^^^^^^^
2026-08-20T09:27:17.320214966+02:00 stderr F 
2026-08-20T09:27:17.320217456+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 138, in synchronize
2026-08-20T09:27:17.320219726+02:00 stderr F     DebDeclarativeVersion(first_stage, repository, mirror=mirror).create()
2026-08-20T09:27:17.320221276+02:00 stderr F 
2026-08-20T09:27:17.320223426+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulpcore/plugin/stages/declarative_version.py", line 172, in create
2026-08-20T09:27:17.320225666+02:00 stderr F     loop.run_until_complete(pipeline)
2026-08-20T09:27:17.320227287+02:00 stderr F 
2026-08-20T09:27:17.320243697+02:00 stderr F   File "/usr/lib64/python3.11/asyncio/base_events.py", line 654, in run_until_complete
2026-08-20T09:27:17.320245817+02:00 stderr F     return future.result()
2026-08-20T09:27:17.320247467+02:00 stderr F            ^^^^^^^^^^^^^^^
2026-08-20T09:27:17.320248987+02:00 stderr F 
2026-08-20T09:27:17.320250717+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulpcore/plugin/stages/api.py", line 238, in create_pipeline
2026-08-20T09:27:17.320252347+02:00 stderr F     await asyncio.gather(*futures)
2026-08-20T09:27:17.320253937+02:00 stderr F 
2026-08-20T09:27:17.320255547+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulpcore/plugin/stages/api.py", line 40, in __call__
2026-08-20T09:27:17.320257997+02:00 stderr F     await self.run()
2026-08-20T09:27:17.320259657+02:00 stderr F 
2026-08-20T09:27:17.320261347+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/asgiref/sync.py", line 577, in thread_handler
2026-08-20T09:27:17.320263017+02:00 stderr F     raise exc_info[1]
2026-08-20T09:27:17.320264588+02:00 stderr F 
2026-08-20T09:27:17.320266188+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 330, in run
2026-08-20T09:27:17.320268258+02:00 stderr F     await self.process_release_file_d_content(d_content, pb)
2026-08-20T09:27:17.320269838+02:00 stderr F 
2026-08-20T09:27:17.320271748+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 342, in process_release_file_d_content
2026-08-20T09:27:17.320273418+02:00 stderr F     release_artifact = self.verify_gpg_artifacts(
2026-08-20T09:27:17.320275068+02:00 stderr F                        ^^^^^^^^^^^^^^^^^^^^^^^^^^
2026-08-20T09:27:17.320276608+02:00 stderr F 
2026-08-20T09:27:17.320278298+02:00 stderr F   File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 403, in verify_gpg_artifacts
2026-08-20T09:27:17.320280038+02:00 stderr F     raise NoValidSignatureForKey(url=os.path.join(self.remote.url, "Release"))
2026-08-20T09:27:17.320281598+02:00 stderr F

It seems the task is trying to gather the Release file from https://deb.nodesource.com/node_22.x/Release what should be https://deb.nodesource.com/node_22.x/dists/nodistro/Release

Same thing happens with Docker repo.
The rest of the remotes are working fine

Do I have a configuration error in the remote?

Do I have a configuration error in the remote?

From a quick look at the repo and your remote, it looks correct to me. If it was working with 3.9, then this sounds like a regression in 3.10. I will go check if we have any suspicious changes between these versions. The other possibility is if the upstream repo changed it's signing key, but that seems unlikely to coinside with your pulp upgrade, especially if you have the same issue with some other repo.

We have a significant gpg handling change (#1481) in 3.10, so that is the most likely culprit.

The missing dists/nodistro from the URL in the error message looks like a red herring to me. I think this is a case of the error message printing a malformed URL rather than the code actually attempting to download the file from the wrong URL.

Yes I reverted back to 3.9 and the sync was working, so 100% sure that it's something in the new version.

I mentioned Docker repo, that is incorrect! I meant Mongo.

Please find the worker log and configuration of trying to sync Mongo, maybe it helps.

{
  "pulp_href": "/pulp/api/v3/remotes/deb/apt/019dfcd5-2948-7f80-84aa-fd9371f0543e/",
  "prn": "prn:deb.aptremote:019dfcd5-2948-7f80-84aa-fd9371f0543e",
  "pulp_created": "2026-05-06T10:28:41.417354Z",
  "pulp_last_updated": "2026-05-24T19:28:26.219096Z",
  "name": "apt-cache_mongo-7_0_trixie",
  "url": "http://repo.mongodb.org/apt/debian",
  "pulp_labels": {},
  "policy": "immediate",
  "hidden_fields": [
    {
      "name": "client_key",
      "is_set": false
    },
    {
      "name": "proxy_username",
      "is_set": false
    },
    {
      "name": "proxy_password",
      "is_set": false
    },
    {
      "name": "username",
      "is_set": false
    },
    {
      "name": "password",
      "is_set": false
    }
  ],
  "ca_cert": null,
  "client_cert": null,
  "tls_validation": true,
  "proxy_url": null,
  "max_retries": null,
  "total_timeout": null,
  "connect_timeout": null,
  "sock_connect_timeout": null,
  "sock_read_timeout": null,
  "headers": null,
  "download_concurrency": null,
  "rate_limit": null,
  "distributions": "trixie/mongodb-org/7.0",
  "components": "main",
  "architectures": "amd64",
  "sync_sources": false,
  "sync_udebs": false,
  "sync_installer": false,
  "gpgkey": "-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQINBGPILWABEACqeWP/ktugdlWEyk7YTXo3n19+5Om4AlSdIyKv49vAlKtzCfMA\nQkZq3mfvjXiKMuLnL2VeElAJQIYcPoqnHf6tJbdrNv4AX2uI1cTsvGW7YS/2WNwJ\nC/+vBa4o+yA2CG/MVWZRbtOjkFF/W07yRFtNHAcgdmpIjdWgSnPQr9eIqLuWXIhy\nH7EerKsba227Vd/HfvKnAy30Unlsdywy7wi1FupzGJck0TPoOVGmsSpSyIQu9A4Z\nuC6TE/NcJHvaN0JuHwM+bQo9oWirGsZ1NCoVqSY8/sasdUc7T9r90MbUcH674YAR\n8OKYVBzU0wch4VTFhfHZecKHQnZf+V4dmP9oXnu4fY0/0w3l4jaew7Ind7kPg3yN\nhvgAkBK8yRAbSu1NOtHDNiRoHGEQFgct6trVOvCqHbN/VToLNtGk0rhKGOp8kuSF\nOJ02PJPxF3/zHGP8n8khCjUJcrilYPqRghZC8ZWnCj6GJVg6WjwLi+hPwNMi8xK6\ncjKhRW3eCy5Wcn73PzVBX9f7fSeFDJec+IfS47eNkxunHAOUMXa2+D+1xSWgEfK0\nPClfyWPgLIXY2pGQ6v8l3A6P5gJv4o38/E1h1RTcO3H1Z6cgZLIORZHPyAj50SPQ\ncjzftEcz56Pl/Cyw3eMYC3qlbABBgsdeb6KB6G5dkNxI4or3MgmxcwfnkwARAQAB\ntDdNb25nb0RCIDcuMCBSZWxlYXNlIFNpZ25pbmcgS2V5IDxwYWNrYWdpbmdAbW9u\nZ29kYi5jb20+iQI+BBMBAgAoBQJjyC1gAhsDBQkJZgGABgsJCAcDAgYVCAIJCgsE\nFgIDAQIeAQIXgAAKCRAWDSa7F4W6OM+eD/sE7KbJyRNWyPCRTqqJXrXvyPqZtbFX\n8sio0lQ8ghn4f7lmb7LnFroUsmBeWaYirM8O3b2+iQ9oj4GeR3gbRZsEhFXQfL54\nSfrmG9hrWWpJllgPP7Six+jrzcjvkf1TENqw4jRP+cJhuihH1Gfizo9ktwwoN9Yr\nm7vgh+focEEmx8dysS38ApLxKlUEfTsE9bYsClgqyY1yrt3v4IpGbf66yfyBHNgY\nsObR3sngDRVbap7PwNyREGsuAFfKr/Dr37HfrjY7nsn3vH7hbDpSBh+H7a0b/chS\nmM60aaG4biWpvmSC7uxA/t0gz+NQuC4HL+qyNPUxvyIO+TwlaXfCI6ixazyrH+1t\nF7Bj5mVsne7oeWjRrSz85jK3Tpn9tj3Fa7PCDA6auAlPK8Upbhuoajev4lIydNd2\n70yO0idm/FtpX5a8Ck7KSHDvEnXpN70imayoB4Fs2Kigi2BdZOOdib16o5F/9cx9\npiNa7HotHCLTfR6xRmelGEPWKspU1Sm7u2A5vWgjfSab99hiNQ89n+I7BcK1M3R1\nw/ckl6qBtcxz4Py+7jYIJL8BYz2tdreWbdzWzjv+XQ8ZgOaMxhL9gtlfyYqeGfnp\nhYW8LV7a9pavxV2tLuVjMM+05ut/d38IkTV7OSJgisbSGcmycXIzxsipyXJVGMZt\nMFw3quqJhQMRsA==\n=gbRM\n-----END PGP PUBLIC KEY BLOCK-----",
  "ignore_missing_package_indices": false
}

pulp [ca6ce1daadef46a79144efbf7e0c73a5]: pulp_deb.app.tasks.synchronizing:INFO: Downloading Release file for distribution: "bookworm/mongodb-org/7.0"
pulp [ca6ce1daadef46a79144efbf7e0c73a5]: pulp_deb.app.tasks.synchronizing:WARNING: Verification of InRelease failed. Removing it.
pulp [ca6ce1daadef46a79144efbf7e0c73a5]: pulp_deb.app.tasks.synchronizing:WARNING: Verification of Release + Release.gpg failed. Removing it.
pulp [ca6ce1daadef46a79144efbf7e0c73a5]: pulpcore.tasking.tasks:INFO: Task[pulp_deb.app.tasks.synchronizing.synchronize] 01a03d12-05a0-73b1-a665-f5e34defbe5b failed (NoValidSignatureForKey: [DEB0002] Unable to verify any Release files from 'http://repo.mongodb.org/apt/debian/Release' using the GPG key provided.) in domain: default
pulp [ca6ce1daadef46a79144efbf7e0c73a5]: pulpcore.tasking.tasks:INFO:   File "/usr/local/lib/python3.11/site-packages/pulpcore/tasking/tasks.py", line 86, in _execute_task
    result = task_function()
             ^^^^^^^^^^^^^^^

  File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 138, in synchronize
    DebDeclarativeVersion(first_stage, repository, mirror=mirror).create()

  File "/usr/local/lib/python3.11/site-packages/pulpcore/plugin/stages/declarative_version.py", line 172, in create
    loop.run_until_complete(pipeline)

  File "/usr/lib64/python3.11/asyncio/base_events.py", line 654, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^

  File "/usr/local/lib/python3.11/site-packages/pulpcore/plugin/stages/api.py", line 238, in create_pipeline
    await asyncio.gather(*futures)

  File "/usr/local/lib/python3.11/site-packages/pulpcore/plugin/stages/api.py", line 40, in __call__
    await self.run()

  File "/usr/local/lib/python3.11/site-packages/asgiref/sync.py", line 577, in thread_handler
    raise exc_info[1]

  File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 330, in run
    await self.process_release_file_d_content(d_content, pb)

  File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 342, in process_release_file_d_content
    release_artifact = self.verify_gpg_artifacts(
                       ^^^^^^^^^^^^^^^^^^^^^^^^^^

  File "/usr/local/lib/python3.11/site-packages/pulp_deb/app/tasks/synchronizing.py", line 403, in verify_gpg_artifacts
    raise NoValidSignatureForKey(url=os.path.join(self.remote.url, "Release"))

Looking at the 45 remotes we have, these are the only ones that contains a "/" in the distributions field. Maybe this is a indication?

@rayzilt

@rayzilt Thanks for this issue report. I believe it contains all the information we need to reproduce and work on this issue. I cannot make promises how soon we will get to it, but I can promise we won't forget it (this will eventually become an internal blocker for us, it is not an immediate blocker, since Katello is currently still based on pulp_deb < 3.10).

Looking at the 45 remotes we have, these are the only ones that contains a "/" in the distributions field. Maybe this is a indication?

My initial reaction is "probably unrelated", but stranger things have happened. Also, your other example was for the remote with "distributions": "nodistro", so that does not have a "/"?

My initial reaction is "probably unrelated", but stranger things have happened. Also, your other example was for the remote with "distributions": "nodistro", so that does not have a "/"?

You are right, I was not paying attention.

Thank you for looking into this! I'll arrange something that covers these remotes :-)

I bumped again against a repository that failed to sync (https://ppa.launchpadcontent.net/deadsnakes/ppa/ubuntu/) and liked to know why. I think I found the reason why some repositories fail to sync.

python-gnupg has been replaced by pysequoia.
pysequoia policy rejects SHA-1 keys.

The keys of the failing repositories contains SHA-1 keys.

So I'm a bit in a pickle what to do, I can contact the owners and ask to upgrade/regenerate their keys. I do not know if pysequoia policy can be less strict on older keys.

Another concrete reproducer for this: the NVIDIA CUDA apt repositories
(e.g. https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/,
signed by EB693B3035CD5710E231E123A4B469963BF863CC). With pulp_deb 3.10.0 on
pulpcore 3.117.1, sync fails with DEB0002 "Unable to verify any Release files".

The key's single user-ID self-signature uses SHA1 (hash algorithm 2, GnuPG 2.0.22
era). pysequoia hard-codes StandardPolicy::new() (src/verify.rs), whose SHA1
second-preimage cutoff is 2023-02, so the certificate is rejected regardless of
the InRelease signature itself, which is SHA256/SHA512. GnuPG 2.4 verifies the
same InRelease fine. NVIDIA has said it will not rotate this key for existing
repos (NVIDIA/cuda-repo-management#39), so a policy escape hatch (per remote or
per instance) would be the practical fix.

Can confirm the issue works when trying to verify the signatures on the popular deadsnakes PPA. The issue seems to be pysequoia (introduced here) flat-out refusing to use any GPG certificate that doesn't follow the rules of Sequoia-PGP's "standard policy".

import pysequoia
deadsnakes_pk = b"""-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFl8fYEBEADQmGZ6pDrwY9iH9DVlwNwTOvOZ7q7lHXPl/TLfMs1tckMc/D9a
hsdBN9VWtMmo+RySvhkIe8X15r65TFs2HE8ft6j2e/4K472pObM1hB+ajiU/wYX2
Syq7DBlNm6YMP5/SyQzRxqis4Ja1uUjW4Q5/Csdf5In8uMzXj5D1P7qOiP2aNa0E
r3w6PXWRTuTihWZOsHv8npyVYDBRR6gEZbd3r86snI/7o8Bfmad3KjbxL7aOdNMw
AqQFaNKl7Y+UJpv1CNFIf+twcOoC0se1SrsVJlAH9HNHM7XGQsPUwpNvQlcmvr+t
1vVS2m72lk3gyShDuJpi1TifGw+DoTqu54U0k+0sZm4pnQVeiizNkefU2UqOoGlt
4oiG9nIhSX04xRlGes3Ya0OjNI5b1xbcYoR+r0c3odI+UCw3VSZtKDX/xlH1o/82
b8ouXeE7LA1i4DvGNj4VSvoxv4ggIznxMf+PkWXWKwRGsbAAXF52rr4FUaeaKoIU
DkJqHXAxrB3PQslZ+ZgBEukkQZF76NkqRqP1E7FXzZZMo2eEL7vtnhSzUlanOf42
ECBoWHVoZQaRFMNbGpqlg9aWedHGyetMStS3nH1sqanr+i4I8VR/UH+ilarPTW3T
E0apWlsH8+N3IKbRx2wgrRZNoQEuyVtvyewDFYShJB3Zxt7VCy67vKAl1QARAQAB
tBxMYXVuY2hwYWQgUFBBIGZvciBkZWFkc25ha2VziQI4BBMBAgAiBQJZfH2BAhsD
BgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAAKCRC6aTI2anVXdvwhD/4oI3yckeKn
9aJNNTJsyw4ydMkIAOdG+jbZsYv/rN73UVQF1RA8HC71SDmbd0Nu80koBOX+USuL
vvhoMIsARlD5dLx5f/zaQcYWJm/BtsMF/eZ4s1xsenwW6PpXd8FpaTn1qtg/8+O9
99R4uSetAhhyf1vSRb/8U0sgSQd38mpZZFq352UuVisXnmCThj621loQubYJ3lwU
LSLs8wmgo4XIYH7UgdavV9dfplPh0M19RHQL3wTyQP2KRNRq1rG7/n1XzUwDyqY6
eMVhdVhvnxAGztvdFCySVzBRr/rCw6quhcYQwBqdqaXhz63np+4mlUNfd8Eu+Vas
b/tbteF/pDu0yeFMpK4X09Cwn2kYYCpq4XujijW+iRWb4MO3G8LLi8oBAHP/k0CM
/QvSRbbG8JDQkQDH37Efm8iE/EttJTixjKAIfyugmvEHfcrnxaMoBioa6h6McQrM
vI8bJirxorJzOVF4kY7xXvMYwjzaDC8G0fTA8SzQRaShksR3USXZjz8vS6tZ+YNa
mRHPoZ3Ua0bz4t2aCcu/fknVGsXcNBazNIK9WF2665Ut/b7lDbojXsUZ3PpuqOoe
GQL9LRj7nmCI6ugoKkNp8ZXcGJ8BGw37Wep2ztyzDohXp6f/4mGgy2KYV9R4S8D5
yBDUU6BS7Su5nhQMStfdfr4FffLmnvFC9w==
=7hFk
-----END PGP PUBLIC KEY BLOCK-----"""
certs = pysequoia.Cert.split_bytes(deadsnakes_pk)

print(certs[0].expiration)

# RuntimeError: No binding signature at time 2026-09-22T09:39:10Z
#
# Caused by:
#    0: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
#    1: SHA1 is not considered secure since 2023-02-01T00:00:00Z

At the moment there doesn't seem to be a way from the pysequoia layer to convince Sequoia-PGP not to do this, which seems like a poor fit considering the dizzying range of PGP settings employed by package maintainers.

Setting gpgkey value to null allows syncing remotes again.
Using the API instead of the pulp CLI is needed as the CLI does not allow 'null'.

REMOTE=remote_name

HREF=$(pulp deb remote show --name "$REMOTE" | jq -r .pulp_href)
TASK=$(curl -sSf -u "$PULP_USER:$PULP_PASS" -X PATCH -H 'Content-Type: application/json' \
  -d '{"gpgkey": null}' "${PULP_URL}${HREF}" | jq -r .task)
pulp task show --href "$TASK" | jq -r .state

Until Launchpad updates the key (as the owner of Deadsnakes for example has no control on it), I have to do this.

looking into this issue I was only able to really reproduce it with the nvidia cuda repo.

the nodesource and deadsnakes repos both have updated their gpg keys using SHA512 self signatures now

$ gpg --list-packets nodesource-repo.asc 2>/dev/null | grep -E 'sigclass|digest algo'
	version 4, created 1768408735, md5len 0, sigclass 0x13
	digest algo 10, begin of digest bd 02
	version 4, created 1464022864, md5len 0, sigclass 0x18
	digest algo 2, begin of digest 4f ce

$ gpg --list-packets deadsnakes.asc 2>/dev/null | grep -E 'sigclass|digest algo'
	version 4, created 1791467415, md5len 0, sigclass 0x13
	digest algo 10, begin of digest 21 eb
	version 4, created 1501330817, md5len 0, sigclass 0x13
	digest algo 2, begin of digest fc 21

The nodesource key was updated in January and the deadsnakes key in October. Updating the gpg keys allowed me to sync the repos again.

As for the nvidia repo I was able to work around this issue. Pulpcore had similar problems and cherry picking this pr to pulpcore pulp/pulpcore#8162 allows to set the sequoia config to not run into this issue like this:

sha1.second_preimage_resistance = "always"
sha1.collision_resistance = "never"

Keep in mind that this will relax the security policy for every repo. There isn't a way to do this on a per repository level. To do this would require changes in both pulpcore and pulp_deb and idk if that's something we want. I have to discuss this first

Navigation Menu

Repository navigation

Unable to verify any Release files since 3.10 #1507

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Unable to verify any Release files since 3.10 #1507

Description

Activity

quba42 commented on Aug 25, 2026

quba42 commented on Aug 25, 2026

quba42 commented on Aug 25, 2026

rayzilt commented on Aug 26, 2026

quba42 commented on Aug 26, 2026

rayzilt commented on Aug 26, 2026

rayzilt commented on Sep 4, 2026

jkudelka-a11y commented on Sep 11, 2026

scottp-dpaw commented on Sep 22, 2026

rayzilt commented on Oct 26, 2026

hstct commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions