Child Item

OpenPGP signature verification failed with Debian Trixie.

Warning: OpenPGP signature verification failed: http://linux.dropbox.com/debian trixie Release: The following signatures were invalid: BADSIG FC918B335044912E Dropbox Automatic Signing Key <linux@dropbox.com>

Error: The package repository 'http://linux.dropbox.com/debian trixie Release' is not signed.

please add new key to: https://linux.dropboxstatic.com/debian/dists/trixie/

Find more posts tagged with

Desktop

Install

Linux

Insightful

Comments

Megan

Hey @Verwijs, let's jump right into this!

Just wanted to check with you, and ask if you're still getting the same message.

Also, what steps do you follow on your end before seeing it?

Keep me posted, and we'll take it from there!

maurom

Hi Verwijs and Megan. I got the same error on a Debian Bookworm system when running `apt update`:

W: GPG error: http://linux.dropbox.com/debian bookworm Release: The following signatures were invalid: BADSIG FC918B335044912E Dropbox Automatic Signing Key <linux@dropbox.com>
E: The repository 'http://linux.dropbox.com/debian bookworm Release' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Strangely enough, downloading and verifying the signature works fine (the downloaded public key is the same I had in my system keyring):

$ echo "Fetch latest release and signature"
$ wget -nv https://linux.dropboxstatic.com/debian/dists/bookworm/Release{,.gpg}
2025-06-04 09:58:45 URL:https://linux.dropboxstatic.com/debian/dists/bookworm/Release [6606/6606] -> "Release" [1]
2025-06-04 09:58:45 URL:https://linux.dropboxstatic.com/debian/dists/bookworm/Release.gpg [488/488] -> "Release.gpg" [1]
FINISHED --2025-06-04 09:58:45--
Total wall clock time: 1.0s
Downloaded: 2 files, 6.9K in 0s (51.8 MB/s)

$ echo "Fetch Dropbox repository public key"
$ wget -nv https://linux.dropbox.com/fedora/rpm-public-key.asc
2025-06-04 10:56:47 URL:https://linux.dropbox.com/fedora/rpm-public-key.asc [975/975] -> "rpm-public-key.asc" [1]

$ echo "Import the public key into a temporary keyring"
$ gpg --no-default-keyring --keyring dropbox-temp.kbx --trust-model always --import rpm-public-key.asc
gpg: key FC918B335044912E: public key "Dropbox Automatic Signing Key <linux@dropbox.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

$ echo "Verify the release file signature"
$ gpg --no-default-keyring --keyring dropbox-temp.kbx --verify Release.gpg Release
gpg: Signature made Fri 30 May 2025 04:08:45 PM -03
gpg:                using RSA key 1C61A2656FB57B7E4DE0F4C1FC918B335044912E
gpg: Good signature from "Dropbox Automatic Signing Key <linux@dropbox.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 1C61 A265 6FB5 7B7E 4DE0  F4C1 FC91 8B33 5044 912E

In my case, it seems the locally cached metadata for the Dropbox repo was stale, so I removed the files listed by this command.

$ find /var/lib/apt/lists -iname "linux.dropbox.com*"
/var/lib/apt/lists/linux.dropbox.com_debian_dists_bookworm_Release.gpg
/var/lib/apt/lists/linux.dropbox.com_debian_dists_bookworm_main_binary-amd64_Packages
/var/lib/apt/lists/linux.dropbox.com_debian_dists_bookworm_Release

This forced apt to re-download the Release, Release.gpg and the Packages file.
Afterward, `apt update` runs properly and without errors.

Megan

Hey @maurom, thank you so much for the heads up!

Your info here will be valuable, and helpful for other users facing the same thing, and hopefully will also resolve @Verwijs issue too.

In any case, I'll be one post away!

steinarb

I get this message once a day after upgrading to debian 13 "trixie" on August 12 2025.

W: http://linux.dropbox.com/debian/dists/sid/Release.gpg: Policy will reject signature within a year, see --audit for details

The relevant output from "apt update --policy", is:

Warning: http://linux.dropbox.com/debian/dists/sid/Release.gpg: Policy will reject signature within a year, see --audit for details
Audit: http://linux.dropbox.com/debian/dists/sid/Release.gpg: Sub-process /usr/bin/sqv returned an error code (1), error message is:
   Signing key on 1C61A2656FB57B7E4DE0F4C1FC918B335044912E is not bound:
              No binding signature at time 2020-03-04T23:26:35Z
     because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
     because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

Looks like you're signing with SHA1 and that will be forbidden by debian APT policy in a year from now.

Nancy

Hey @steinarb, as a first, can you make sure that your device is following all the supported requirements mentioned here? Feel free to also check out this Help Center article.

We'll go from there.

steinarb

I don't have neither Ubuntu, nor Fedora (as listed in the requirements) and no intentions of switching to either.

I do have debian, on which Ubuntu is based, and I do have a much newer debian than what Ubuntu 18 is based on (debian 13 "trixie", the current debian stable, which was released on August 9 2025).

The Dropbox debian package for Ubuntu has worked well for me on debian stable, since at least 2016, and still works.

But I am currently getting daily nags from debian APT because the APT archive of the debian package is signed which SHA1, which is not considered secure anymore, and because of this debian APT (and possibly later Ubuntu APT as well...?) will start rejecting the archive in less than one year.

So what you should do(and that you should do in any case...) is to upgrade the key used for signing your APT archive.

I.e. no changes to the code, just a change to the archive (including resigning of the packages, I guess...?).

Hannah

Thanks for your update here, @steinarb.

I'm afraid that if the minimum system requirements are not met, issues like this are kind of expected.

I did, however, pass your comments and feedback along to our team about this.

Let us know if you have any other questions.

daves415

"I'm afraid that if the minimum system requirements are not met, issues like this are kind of expected."

That is a disjoint reply. Are you saying that accepting obsolete SHA1 signatures is a "minimum system requirement"?

slimy_asparagus

I am having the same issues. I would rather stop using the dropbox app than stop using Debian.

Hannah

I understand where you're coming from, @daves415 and you as well @slimy_asparagus. I did pass your feedback along to our team, so your comments are very appreciated.

Let us know if you need anything else.

Orange F.

I am having the same issue, and I find the use of the SHA1 signatures very concerning in terms of trusting the security commitments of Dropbox. As a loyal customer who has been paying for Dropbox for twenty years or so, I hope this issue is given priority as a security concern.

maurom

I fully agree with the previous posters. While it is technically possible to relax the cryptographic policies of our platforms to keep using the Dropbox repository with its deprecated SHA-1 signature, Debian and other modern distributions are flagging said signatures as insecure for good reasons. This is quickly becoming a blocking problem for those who want to keep Dropbox integrated without compromising our system security.

Having said that, we appreciate that this issue has been escalated internally, and we'd be very grateful if it could be prioritized so the repository is re-signed with a stronger algorithm, ensuring continued compatibility and security across all supported platforms.

Thanks in advance.

dan s.3

@Hannah : Is there any progress on this?

Nancy

I’m afraid there are currently no updates on this, @dan s.3.

daves415

The messaging in "sudo apt update --audit" indicates that Dropbox will be broken in Debian on February 1st 2026.

ObsidianR

This error persists, meaning we will lose Dropbox in Debian by February if it's not actioned...

Jay

Hi @ObsidianR, just to clarify, could you confirm that you've followed the previous steps in this thread in relation to removing and redownloading the package?

daves415

Please understand that this situation currently affects all users of Debian Stable or newer.

There is a deadline, after which no updates will be accepted from the Dropbox repository.

This situation will very likely migrate to downstream Linux Distributions, including Ubuntu.

ObsidianR

I did, it does not fix the issue for me.

To be fair, the error clearly states what the issue is and what the solution is too. It just needs to be changed to an up to date file format.

If this is not done soon, Dropbox will cease to function in all Debian-based distros, including Ubuntu which is listed as compatible in your documentation.

It is a genuinely simple fix if the dev team is notified.

slimy_asparagus

Is anyone talking to the Ubuntu devs about this? Like at some point this will be in Ubuntu. Maybe it is already in a dev version. Dropbox should care about that even if they don't care about Debian directly.

ObsidianR

Or they could go and validate their flatpak. That way we at least have something that works in all distros even if it's not optimal...

slimy_asparagus

I have no interest in flatpak. And I think the work required would be more than fixing it for Debian. (I understand flatpak users may have a different perspective.)

If Dropbox stops working for me, I shall switch to a Dropbox competitor.

Roesjka

I have the same issue as @steinarb @daves415 and @slimy_asparagus. Running Debian Forky/Sid but it also happened on Trixie. Don't come to me about the minimum requirements as I exceed all the requirements mentioned.

Warning: https://linux.dropbox.com/debian/dists/sid/Release.gpg: Policy will reject signature within a year, see --audit for details.

Dell_Dropbox

Hello all,

A fix has been created for this issue and we expect the update to be pushed out by next week. Thanks to everyone for the patience you've shown, much appreciated!