nvidia-toolkit repo is failing to fetch on Debian 13 due to SHA1

[gouthamravee]

Not sure if this is an issue, since I don't see any other post about it. Figured I'll start with a discussion.

I'm trying to update with apt on a Debian 13 based system, apt update and I'm getting the error below

sudo apt update
Hit:1 https://deb.debian.org/debian trixie InRelease
Get:2 https://deb.debian.org/debian-security trixie-security InRelease [43.4 kB]                                                                  
Get:3 https://download.docker.com/linux/debian trixie InRelease [32.5 kB]                                                                         
Hit:4 https://nvidia.github.io/libnvidia-container/stable/deb/amd64  InRelease                                                                    
Get:5 https://deb.debian.org/debian trixie-updates InRelease [47.3 kB]                                                                            
Hit:6 https://developer.download.nvidia.com/compute/cuda/repos/debian11/x86_64  InRelease                 
Get:7 https://deb.debian.org/debian trixie-backports InRelease [54.0 kB]
Err:6 https://developer.download.nvidia.com/compute/cuda/repos/debian11/x86_64  InRelease
  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on EB693B3035CD5710E231E123A4B469963BF863CC is not bound:            No binding signature at time 2025-10-13T15:09:54Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Get:8 https://deb.debian.org/debian-security trixie-security/main amd64 Packages [98.8 kB]
Get:9 https://deb.debian.org/debian trixie-backports/main amd64 Packages.diff/Index [63.3 kB]
Hit:10 https://dietpi.com/apt trixie InRelease                                  
Get:11 https://deb.debian.org/debian trixie-backports/main amd64 Packages T-2026-02-03-1959.51-F-2026-02-03-0759.37.pdiff [1180 B]
Get:11 https://deb.debian.org/debian trixie-backports/main amd64 Packages T-2026-02-03-1959.51-F-2026-02-03-0759.37.pdiff [1180 B]
Fetched 340 kB in 1s (252 kB/s)
2 packages can be upgraded. Run 'apt list --upgradable' to see them.
Warning: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP signature verification failed: https://developer.download.nvidia.com/compute/cuda/repos/debian11/x86_64  InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on EB693B3035CD5710E231E123A4B469963BF863CC is not bound:            No binding signature at time 2025-10-13T15:09:54Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Warning: Failed to fetch https://developer.download.nvidia.com/compute/cuda/repos/debian11/x86_64/InRelease  Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on EB693B3035CD5710E231E123A4B469963BF863CC is not bound:            No binding signature at time 2025-10-13T15:09:54Z   because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
Warning: Some index files failed to download. They have been ignored, or old ones used instead.

The part that sticks out to me is

Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance   because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

Is this a repo issue or PEBCAK? I installed the toolkit on this system following the documentation here: https://docs.nvidia.com/datacenter/cloud-native/container-toolkit/latest/install-guide.html

What I don't understand is another system with basically the same configuration except for different services running in docker doesn't have this issue with apt.

[gouthamravee]

Nvm I'm an idiot, I wasn't looking hard enough at the error and missed the actual repo that was causing the problem. I also had a repo for cuda-debian11 setup on this system. That was the issue. Deleted that apt file and now all is well.