Signature verification error during apt update

FlightAware ADS-B Flight Tracking
1

I “upgraded” (in-place, not a re-image) from Bullseye to Trixie some months ago and have had no apparent issues until today.

When I run sudo apt update, get this error below:

Hit:5 ``https://www.flightaware.com/adsb/piaware/files/packages`` bookworm InRelease
Err:5 ``https://www.flightaware.com/adsb/piaware/files/packages`` bookworm InRelease
Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 4E49CAF6B9F2BF8FC240E4BAB931BB28DE85F0DD is not bound: No binding signature at time 2025-06-30T15:04:16Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
All packages are up to date.
Warning: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: ``https://www.flightaware.com/adsb/piaware/files/packages`` bookworm InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 4E49CAF6B9F2BF8FC240E4BAB931BB28DE85F0DD is not bound: No binding signature at time 2025-06-30T15:04:16Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Warning: Failed to fetch ``https://flightaware.com/adsb/piaware/files/packages/dists/bookworm/InRelease`` Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 4E49CAF6B9F2BF8FC240E4BAB931BB28DE85F0DD is not bound: No binding signature at time 2025-06-30T15:04:16Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Warning: Some index files failed to download. They have been ignored, or old ones used instead.

The flight aware sources file contains this

This file is automatically generated by the flightaware-apt-repository package

to point to the correct FlightAware repository for the currently installed Debian OS.

Any changes made to this file will be lost when flightaware-apt-repository is reconfigured.



To disable generation of this file:

purge the flightaware-apt-repository package; or

set ENABLED=no in /etc/default/flightaware-apt-repository; or

rename this file to /etc/apt/sources.list.d/flightaware-apt-repository.list.disabled

deb [ signed-by=/usr/share/keyrings/flightaware-archive-keyring.gpg ] https://flightaware.com/adsb/piaware/files/packages>

I assume my local flightaware-archive-keyring.gpg is perhaps out of date/incorrect.

Does anyone know how I can correct this error?

Thanks in advance!

Graeme

2

On Raspberry Pi OS Trixie
(OS written on a blank microSD card using RPi Imager)

FLIGHTAWARE

20260201_165752
20260201_1657521078×718 167 KB

 

FLIGHTRADAR24

20260201_165901
20260201_1659011070×1154 321 KB

 
PIAWARE FROM MY PPA AT GITHUB

Click Here: Debian 13

Screenshot_20260201_171615_Samsung Internet
Screenshot_20260201_171615_Samsung Internet1043×1380 240 KB

 

3

Thanks for looking into this. I’ve since read that Debian 13 (Trixie) considers SHA1 insecure starting 1 Feb 2026. It would seem the repository .gpg key needs updating for Trixie!

1 Like
4

The gpg key at my Github PPA meets this requirement, hence the apt can update it without any issue, and the 64-bit (arm64 & amd64) piaware, dump1090-fa, dump978-fa and piaware-web can be installed on 64-bit (arm64 & amd64) Trixie without any problem.

 

5

Flightradar24 has just now provided following method to download and install their updated gpg key on Trixie:

NOTE :
The 2nd command below is very long. Scroll right to see and copy it in full

sudo -s

wget -O- https://repo-feed.flightradar24.com/flightradar24.2026.pub | gpg --dearmor > /etc/apt/keyrings/flightradar24.gpg​

apt-get update​

FR24 New Key Data (for information only)

FR24 New Key For Trixie 20260202
FR24 New Key For Trixie 202602021080×447 159 KB

 

1 Like
6

I wonder if FlightAware will consider doing the same for the bookworm repository. My Pi is still pointing to the Bookworm repository for updates despite being on Trixie and I appreciate I now have a non-standard setup…

I’ve now extended the SHA1 acceptance policy by another 6 months on my installation in case any updates/fixes get released in that that time

Thanks again for the feedback!

7

Compare the gpg Keys

 

(1) Flightaware CURRENT Key

image
image769×146 14.5 KB

 

(2) Flightradar24 OLD Key

image
image694×178 14.8 KB

 

(3) Flightradar24 NEW Key

image
image709×234 23.4 KB

 

8

Any updates on this? Having the same problem on bookworm!