Package: apt
Version: 3.0.3
Severity: normal

With two signatures on an InRelease and a Signed-By that names one of
them by fingerprint, the sqv method can refuse a signature that is
valid today.

VerifyGetSigners runs sqv with --policy-as-of one year ahead first, and
only if that run fails, runs it again at today's policy. URIAcquire
then keeps the signers whose fingerprint is in Signed-By. If the other
key passes next year's policy, the first run succeeds, its signers
replace today's, the fingerprint filter leaves nothing, and the
repository fails with

    No good signature from required signer: <fingerprint>
    E: The repository '...' is not signed.

To reproduce: InRelease signed by A (ed25519) and B (rsa3072), keyring
with both, Signed-By: <keyring>, <fingerprint of B>, and a policy that
cuts rsa3072 inside the coming year (APT_SEQUOIA_CRYPTO_POLICY with
[asymmetric_algorithms] rsa3072 = 2027-03-01).

    A+B signed, pinned to B, no cutoff:        accepted
    B signed only, pinned to B, with cutoff:   accepted, "Policy will
reject signature within a year"
    A+B signed, pinned to B, with cutoff:      refused, "is not signed"

The last two differ only in A's signature being there.

With the default policy nothing falls inside the year today. It will
from 2027-02-01 for Brainpool keys (cut 2028-02-01) and from 2029-02-01
for RSA 2048 (cut 2030-02-01), for a repository signed with an old and
a new key while users still pin the old one.

Filtering by Signed-By inside each run, or falling through to today's
run when the filtered set is empty, would keep the warning and the
update. The code is the same on main.