Debians commandline package manager https://git.kalnischkies.de/apt/atom?h=2.9.19 2024-12-22T22:52:05Z 2024-12-22T22:52:05Z Julian Andres Klode julian.klode@canonical.com 2024-12-20T10:21:29Z urn:sha1:153653d449efe121487641303d43ac523b9b17fb Many repositories still have SHA-1 self-signatures, and they are not security relevant for APT repositories in the first place since we do not use a web of trust model, but rather a set of trusted keyrings, and the subkey can essentially be always considered trusted even if it cannot be verified.