| Description | Description:
On a clean, untouched installation of Kali Purple (kali-rolling), running sudo apt update immediately fails on the pre-configured Elastic repository (/etc/apt/sources.list.d/elastic.sources) due to /usr/bin/sqv rejecting the signature (SHA-1 policy violation).
However, manually re-fetching and dearmoring the latest GPG key directly from Elastic fixes the issue completely, indicating that the default key bundled in the Kali Purple image/package is outdated and carries a deprecated SHA-1 binding signature.
Error log on unmodified system:
Get:2 https://artifacts.elastic.co/packages/8.x/apt stable InRelease [3,249 B]
Err:2 https://artifacts.elastic.co/packages/8.x/apt stable InRelease
Sub-process /usr/bin/sqv returned an error code (1), error message is: Signing key on 46095ACC8548582C1A2699A9D27D666CD88E42B4 is not bound: No binding signature at time 2026-10-06T09:46:46Z because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance because: SHA1 is not considered secure since 2026-02-01T00:00:00Z
W: Signature verification failed: https://artifacts.elastic.co/packages/8.x/apt stable InRelease: Sub-process /usr/bin/sqv returned an error code (1)
E: The repository 'https://artifacts.elastic.co/packages/8.x/apt stable InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
Verification & Root Cause:
- Default / Clean State:
With no modifications after installation, sudo apt update throws the sqv SHA-1 rejection error above.
- Fix Confirmed:
Running:
curl -fsSL https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor --yes -o /usr/share/keyrings/elastic-archive-keyring.gpg
and referencing it in /etc/apt/sources.list.d/elastic.sources immediately resolves the problem, and sudo apt update succeeds.
Conclusion / Suggested Fix:
The Elastic GPG keyring bundled out-of-the-box in Kali Purple needs to be refreshed in the default packages/rootfs with the current upstream key to prevent out-of-the-box update failures for new users. |
|---|
