It's just a silly misunderstanding, caused by the hasty recognition of the development team of apt maintainers about SHA1 algorithm as obsolete. The problem is that it is directly embedded in the source code of APT, but if you're willing to spend an extra 1-2 hours on the self-assembly of the package, I can tell you how to solve this nuisance. So:
sudo aptitude install git --with-recommends
mkdir build && cd build
git clone https://anonscm.debian.org/git/apt/apt.git --recursive && cd apt && git pull && ls
gedit methods/gpgv.cc
(Other cloning URLs can be found at http://anonscm.debian.org/cgit/apt/apt.git/.)
And correct this section of code as present below:
static constexpr Digest Digests[] = {
{Digest::State::Untrusted, "Invalid digest"},
{Digest::State::Untrusted, "MD5"},
{Digest::State::Trusted, "Reserved digest"},
{Digest::State::Trusted, "Reserved digest"},
{Digest::State::Trusted, "Reserved digest"},
{Digest::State::Trusted, "Reserved digest"},
{Digest::State::Trusted, "SHA1"},
{Digest::State::Trusted, "RIPE-MD/160"},
{Digest::State::Trusted, "SHA256"},
{Digest::State::Trusted, "SHA384"},
{Digest::State::Trusted, "SHA512"},
{Digest::State::Trusted, "SHA224"},
};
Then:
dpkg-buildpackage -b -uc -us -nc -rfakeroot
cd .. && rm -vf *dbg* *doc* *dev* && sudo dpkg -i *.deb
sudo apt update