# Bug OP-17993 - When using the Debian repository from packager.io and the new deb822 format a warning appears

Project: OpenProject
Status: closed
URL: https://community.openproject.org/work_packages/OP-17993

## Open points

_No work packages_

## Details

| Attribute | Value |
| --- | --- |
| Date |  |
| Priority | Medium |
| Module | DevSecOps / Installer and packaging |
| Target versions |  |
| Observed in versions |  |
| Sprint |  |
| Backlog bucket |  |
| Bug found in version (deprecated) |  |
| Found in mobile app version |  |
| Follow-up feedback e-mail |  |
| Requires doc change | No |
| Accessibility | No |
| Pull preview |  |
| List |  |
| Labels |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers |  |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Planning

| Attribute | Value |
| --- | --- |
| Relevance |  |

## Costs

| Attribute | Value |
| --- | --- |
| Votes |  |
| Work |  |
| Labor costs |  |

## Description

### Steps to reproduce

Set up a debian system and follow instructions at [https://www.openproject.org/docs/installation-and-operations/installation/packaged/](https://www.openproject.org/docs/installation-and-operations/installation/packaged/) to add the repo to Debian, except that you use the new deb822 format instead of the old format.

### What is the buggy behavior?

When doing an apt update the following warning appears. 

Warning: http://dl.packager.io/srv/deb/opf/openproject/stable/15/debian/dists/12/InRelease: Policy will reject signature within a year, see --audit for details

### What is the expected behavior?

No such warning

### Important note

The key uses SHA1 hashing, that should be upgraded to at least sha256

If you can self upgrade the key then please do so, or get Cyril Rohr at packager.io to do that for you.

<br>