René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Upcoming PGP signing key rotation for GitHub CLI Linux packages [September 2026]","articleBody":"> [!NOTE]\n> This issue only affects Linux users who install `gh` from our APT or RPM package repositories. If you are on Windows or macOS, or you installed `gh` via Homebrew, GitHub Releases, or built from source code, this does not apply to you.\n\n \n- [What's happening?](#whats-happening)\n- [Am I affected?](#am-i-affected)\n- [How to confirm locally installed keyring?](#how-to-confirm-locally-installed-keyring)\n  - [Debian/Ubuntu](#debianubuntu)\n  - [RHEL/Fedora/CentOS/openSUSE/SUSE/Amazon Linux 2](#rhelfedoracentosopensusesuseamazon-linux-2)\n- [What do I need to do?](#what-do-i-need-to-do)\n  - [New users](#new-users)\n  - [Existing APT users (Debian/Ubuntu)](#existing-apt-users-debianubuntu)\n    - [Docker build failing?](#docker-build-failing)\n  - [Existing RPM users (Fedora, RHEL, CentOS, Amazon Linux 2, openSUSE/SUSE)](#existing-rpm-users-fedora-rhel-centos-amazon-linux-2-opensusesuse)\n    - [DNF5 (Fedora 41 or newer)](#dnf5-fedora-41-or-newer)\n    - [DNF4 (CentOS, RHEL, Fedora 40 or earlier)](#dnf4-centos-rhel-fedora-40-or-earlier)\n    - [Yum (Amazon Linux 2)](#yum-amazon-linux-2)\n    - [Zypper (openSUSE/SUSE)](#zypper-opensusesuse)\n    - [Removing old key from RPM keyrings](#removing-old-key-from-rpm-keyrings)\n- [Background](#background)\n- [Final notes](#final-notes)\n\n\n## \u003ca id=\"whats-happening\">What's happening?\u003c/a>\n\nThe PGP key currently used to verify GitHub CLI Linux packages is expiring on **Saturday, September 5, 2026**. We have generated a new key and have already published an updated keyring file that contains both the old and new keys on **Wednesday, April 8, 2026**. This table lists the current and the new PGP key fingerprint:\n\n| Key | Fingerprint |\n|---|---|\n| Current key (expires September 5, 2026) | `2C6106201985B60E6C7AC87323F3D4EA75716059` |\n| New key | `7F38BBB59D064DBCB3D84D725612B36462313325` |\n\n> [!NOTE]\n> The new key does not have a fixed expiration date, but this does not necessarily mean that it is permanent. Choosing a key without a fixed expiration date supports our goal of keeping package installation and update processes smooth while minimizing disruption to our users. If and when we decide to rotate this key, we will announce the change publicly and provide clear instructions for any required action.\n\nAs a background, back in September 2024, [our PGP signing key expired (#9569)](https://github.com/cli/cli/issues/9569), disrupting Linux package installs and updates. At that time, we extended the expiration of the existing key as an emergency fix. This time, however, we are proactively rotating to a brand-new key well ahead of the expiry date.\n\nCheck out [Am I affected?](#am-i-affected) below to see if you are going to be affected by this change. For affected users, package install and update operations that rely on the old key will start failing after the expiry date unless you follow the steps outlined in this document. Typical error/warning messages look like any of the following:\n\n```\nW: Failed to fetch https://cli.github.com/packages/dists/stable/InRelease  The following signatures were invalid: EXPKEYSIG 23F3D4EA75716059 GitHub CLI \u003copensource+cli@github.com> The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5612B36462313325\n```\n\n```\nTransaction failed: Signature verification failed.\nOpenPGP check for package ... from repo \"gh-cli\" has failed: Import of the key didn't help, wrong key?\n```\n\n```\nThe GPG keys listed for the \"packages for the GitHub CLI\" repository are already installed but they are not correct for this package.\nCheck that the correct key URLs are configured for this repository.. Failing package is: gh...\n GPG Keys are configured as: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x23F3D4EA75716059\n...\nError: GPG check FAILED\n```\n\n```\nThe GPG keys listed for the \"packages for the GitHub CLI\" repository are already installed but they are not correct for this package.\nCheck that the correct key URLs are configured for this repository.\n\n Failing package is: gh...\n GPG Keys are configured as: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x23F3D4EA75716059\n```\n\n```\nWarning: File 'repomd.xml' from repository 'packages for the GitHub CLI' is signed with an unknown key '5612B36462313325'\n...\n    Warning: We can't verify that no one meddled with this file, so it might not be\n    trustworthy anymore! You should not continue unless you know it's safe.\n...\nRepository 'packages for the GitHub CLI' is invalid.\n[gh-cli|https://cli.github.com/packages/rpm] Valid metadata not found at specified URL\nHistory:\n - Signature verification failed for repomd.xml\n - Can't provide /repodata/repomd.xml\n```\n\n```\ngh-... (packages for the GitHub CLI): Signature verification failed [4-Signatures public key is not available]\n```\n\n```\nWarning: File 'repomd.xml' from repository 'packages for the GitHub CLI' is signed with an unknown key '5612B36462313325'\n...\n    Warning: We can't verify that no one meddled with this file, so it might not be\n    trustworthy anymore! You should not continue unless you know it's safe.\n...\nRepository 'packages for the GitHub CLI' is invalid.\n[gh-cli|https://cli.github.com/packages/rpm] Failed to retrieve new repository metadata.\nHistory:\n - Signature verification failed for repomd.xml\n```\n\n```\nerror: Verifying a signature using certificate 2C6106201985B60E6C7AC87323F3D4EA75716059 (GitHub CLI \u003copensource+cli@github.com>):\n  1. Certificate 23F3D4EA75716059 invalid: certificate is not alive\n      because: The primary key is not live\n      because: Expired on 2026-09-05T12:44:10Z\n  2. Key 23F3D4EA75716059 invalid: key is not alive\n      because: The primary key is not live\n      because: Expired on 2026-09-05T12:44:10Z\n```\n\n## \u003ca id=\"am-i-affected\">Am I affected?\u003c/a>\n\n| Scenario | Affected? |\n|---|---|\n| You cannot install or upgrade `gh` | Probably. See [Existing APT users](#existing-apt-users-debianubuntu) or [Existing RPM users](#existing-rpm-users-fedora-rhel-centos-amazon-linux-2-opensusesuse). |\n| Installed `gh` via `apt` **before** the new keyring was published (April 8, 2026) and haven't re-run the installation steps since | **Yes**. See [Existing APT users](#existing-apt-users-debianubuntu). |\n| Installed `gh` via `dnf`, `yum`, or `zypper` **before** the new keyring was published (April 8, 2026) and haven't re-run the installation steps since | **Yes**. See [Existing RPM users](#existing-rpm-users-fedora-rhel-centos-amazon-linux-2-opensusesuse). |\n| Installed `gh` using official docs **after** the new keyring was published (April 8, 2026) | **No**. Your keyring already contains the new key. |\n| Installed `gh` via Homebrew, Conda, a community package manager, or from precompiled binaries | **No**. These methods do not use our PGP key. |\n| You do not remember when you installed `gh` | See [How to confirm locally installed keyring?](#how-to-confirm-locally-installed-keyring) |\n\n\n## \u003ca id=\"how-to-confirm-locally-installed-keyring\">How to confirm locally installed keyring?\u003c/a>\n\nIf you do not remember when you installed `gh` from the official docs, you can easily confirm if you are going to be affected by checking your local configuration. Follow the subsection that applies to you.\n\n### \u003ca id=\"debianubuntu\">Debian/Ubuntu\u003c/a>\n\n> [!TIP]\n> If `gpg` is not installed, you can install it with:\n> ```shell\n> sudo apt update\n> sudo apt install gnupg\n> ```\n\nCheck how many keys are in your local keyring file:\n\n```shell\ngpg --show-keys /etc/apt/keyrings/githubcli-archive-keyring.gpg\n```\n\n> [!TIP]\n> If the file is not found at that path, try the older location:\n>\n> ```shell\n> gpg --show-keys /usr/share/keyrings/githubcli-archive-keyring.gpg\n> ```\n>\n> If you still cannot find the keyring file, check your APT source entry to see the path it references:\n>\n> ```shell\n> cat /etc/apt/sources.list.d/github-cli.list\n> ```\n>\n> Look for the `signed-by=` value in the output, which points to your keyring file path.\n\nIf the output shows **two** public key entries (with fingerprints `2C6106201985B60E6C7AC87323F3D4EA75716059` and `7F38BBB59D064DBCB3D84D725612B36462313325`), you already have the updated keyring and no action is needed. This is what the output should look like:\n\n```\npub   rsa4096 2022-09-06 [SC] [expires: 2026-09-05]\n      2C6106201985B60E6C7AC87323F3D4EA75716059\nuid                      GitHub CLI \u003copensource+cli@github.com>\nsub   rsa4096 2022-09-06 [E] [expires: 2026-09-05]\n\npub   rsa4096 2026-04-07 [SC]\n      7F38BBB59D064DBCB3D84D725612B36462313325\nuid                      GitHub CLI \u003copensource+cli@github.com>\nsub   rsa4096 2026-04-07 [E]\n```\n\nIf only **one** key is listed (the old key `2C6106201985B60E6C7AC87323F3D4EA75716059`), you need to update your keyring. See [Existing APT users](#existing-apt-users-debianubuntu).\n\n### \u003ca id=\"rhelfedoracentosopensusesuseamazon-linux-2\">RHEL/Fedora/CentOS/openSUSE/SUSE/Amazon Linux 2\u003c/a> \n\nCheck which GitHub CLI keys are imported in your RPM keyring:\n\n```shell\nrpm -qa gpg-pubkey | xargs -I{} sh -c 'rpm -qi {} | grep -q \"opensource+cli@github.com\" && echo {}'\n```\n\nIf the output includes **only** one entry (the old key), you will need to update. See [Existing RPM users](#existing-rpm-users-fedora-rhel-centos-amazon-linux-2-opensusesuse).\n\nIf you see a second key entry, your system already has the new key and no action is needed.\n\n## \u003ca id=\"what-do-i-need-to-do\">What do I need to do?\u003c/a>\n\n### \u003ca id=\"new-users\">New users\u003c/a>\n\nIf you are installing `gh` for the first time, simply follow the standard [Linux installation instructions](https://github.com/cli/cli/blob/trunk/docs/install_linux.md). The current keyring file already contains the new key, so no extra steps are needed. This also applies if you installed `gh` for the first time after the new keyring was published (April 8, 2026).\n\n### \u003ca id=\"existing-apt-users-debianubuntu\">Existing APT users (Debian/Ubuntu)\u003c/a>\n\nYou need to replace your local copy of the keyring file. Run either of the following commands to download the updated keyring:\n\n```shell\n# Using wget\nsudo mkdir -p -m 755 /etc/apt/keyrings\nsudo wget -qO /etc/apt/keyrings/githubcli-archive-keyring.gpg https://cli.github.com/packages/githubcli-archive-keyring.gpg \\\n    && sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg\n\n# Using curl\nsudo mkdir -p -m 755 /etc/apt/keyrings\nsudo curl -fsSL -o /etc/apt/keyrings/githubcli-archive-keyring.gpg https://cli.github.com/packages/githubcli-archive-keyring.gpg \\\n    && sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg\n```\n\nThen update your package lists and upgrade `gh`:\n\n```shell\nsudo apt update\nsudo apt install gh\n```\n\n> [!NOTE]\n> If your keyring file is located elsewhere (e.g., under `/usr/share/keyrings/`), you should update that path in the command above. However, the recommended location is `/etc/apt/keyrings/`. Regardless of the path, make sure the `signed-by` field in the APT source entry (at `/etc/apt/sources.list.d/github-cli.list`) points at the right keyring file.\n\n> [!TIP]\n> You can verify the updated keyring contains both keys by running:\n> ```shell\n> gpg --show-keys /etc/apt/keyrings/githubcli-archive-keyring.gpg\n> ```\n> You should see an output like this:\n> ```\n> pub   rsa4096 2022-09-06 [SC] [expired: 2026-09-05]\n>       2C6106201985B60E6C7AC87323F3D4EA75716059\n> uid                      GitHub CLI \u003copensource+cli@github.com>\n> sub   rsa4096 2022-09-06 [E] [expired: 2026-09-05]\n>\n> pub   rsa4096 2026-04-07 [SC]\n>       7F38BBB59D064DBCB3D84D725612B36462313325\n> uid                      GitHub CLI \u003copensource+cli@github.com>\n> sub   rsa4096 2026-04-07 [E]\n> ```\n\n#### \u003ca id=\"docker-build-failing\">Docker build failing?\u003c/a>\n\nIf your Docker build is failing because a layer previously added our package repository and a later layer runs `apt update` or `apt-get update`, you need to ensure the updated keyring is present.\n\nIf you control the layer that adds the keyring, rebuild it so it pulls the latest keyring file.\n\nIf you don't control that layer, add a new layer **before** any `apt update` or `apt-get update` that fetches the updated keyring:\n\n```dockerfile\nRUN wget -qO /etc/apt/keyrings/githubcli-archive-keyring.gpg https://cli.github.com/packages/githubcli-archive-keyring.gpg \\\n    && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg\n```\n\nOr if you prefer using `curl`:\n\n```dockerfile\nRUN curl -fsSL -o /etc/apt/keyrings/githubcli-archive-keyring.gpg https://cli.github.com/packages/githubcli-archive-keyring.gpg \\\n    && chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg\n```\n\nIf you don't use `gh` at all and it just happens to be in a base image, you can remove the repository so that `apt update` or `apt-get update` no longer try to verify it:\n\n```shell\nsudo rm /etc/apt/sources.list.d/github-cli.list\n```\n\n### \u003ca id=\"existing-rpm-users-fedora-rhel-centos-amazon-linux-2-opensusesuse\">Existing RPM users (Fedora, RHEL, CentOS, Amazon Linux 2, openSUSE/SUSE)\u003c/a>\n\nRPM-based systems import PGP keys into their own keyring at install time. To pick up the new key, you need to re-fetch the repository configuration file, which now references an updated keyring. Choose the instructions matching your package manager below.\n\nNote that when upgrading `gh` at the end, your package manager will prompt you to confirm importing the PGP keys. Verify that the key fingerprints match the following:\n\n- Old key: `2C6106201985B60E6C7AC87323F3D4EA75716059`\n- New key: `7F38BBB59D064DBCB3D84D725612B36462313325`\n\n> [!IMPORTANT]\n> Instructions below mimic our [Linux installation guide](https://github.com/cli/cli/blob/trunk/docs/install_linux.md). So, please make sure you follow the heading that you originally used to install `gh`. \n\n#### \u003ca id=\"dnf5-fedora-41-or-newer\">DNF5 (Fedora 41 or newer)\u003c/a>\n\n> [!TIP]\n> Run `dnf --version` if you are unsure what version you are using.\n\n> [!NOTE]\n> Ensure the `config-manager` plugin is installed (for example, `sudo dnf install dnf5-plugins`).\n\n```shell\nsudo dnf config-manager addrepo --overwrite --from-repofile=https://cli.github.com/packages/rpm/gh-cli.repo\nsudo dnf update gh\n```\n\n#### \u003ca id=\"dnf4-centos-rhel-fedora-40-or-earlier\">DNF4 (CentOS, RHEL, Fedora 40 or earlier)\u003c/a>\n\n> [!TIP]\n> Run `dnf --version` if you are unsure what version you are using.\n\n> [!NOTE]\n> Ensure the `config-manager` plugin is installed (for example, `sudo dnf install 'dnf-command(config-manager)'`).\n\n```shell\nsudo dnf config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo\nsudo dnf update gh\n```\n\n#### \u003ca id=\"yum-amazon-linux-2\">Yum (Amazon Linux 2)\u003c/a>\n\n> [!NOTE]\n> Ensure the `config-manager` plugin is installed (for example, `sudo yum install yum-utils`).\n\n```shell\nsudo yum-config-manager --add-repo https://cli.github.com/packages/rpm/gh-cli.repo\nsudo yum update gh\n```\n\n#### \u003ca id=\"zypper-opensusesuse\">Zypper (openSUSE/SUSE)\u003c/a>\n\n```shell\nsudo zypper removerepo gh-cli\nsudo zypper addrepo https://cli.github.com/packages/rpm/gh-cli.repo\nsudo zypper update gh\n```\n\n#### \u003ca id=\"removing-old-key-from-rpm-keyrings\">Removing old key from RPM keyrings\u003c/a>\n\nIf you still encounter key verification errors after re-adding the repository, you may need to remove the old key from the RPM keyring first:\n\n1. Find the old PGP key:\n   ```shell\n   sudo rpm -qa gpg-pubkey\n   ```\n   Our old PGP key is usually named `gpg-pubkey-75716059-63172e8a` or `gpg-pubkey-2c6106201985b60e6c7ac87323f3d4ea75716059-63172e8a`. You can confirm the correct key by checking its Packager field:\n\n   ```shell\n   sudo rpm -qi gpg-pubkey-75716059-63172e8a\n   # or\n   sudo rpm -qi gpg-pubkey-2c6106201985b60e6c7ac87323f3d4ea75716059-63172e8a\n   ```\n   The Packager should be `GitHub CLI \u003copensource+cli@github.com>`.\n2. Once you have confirmed the Packager, remove the old PGP key:\n   ```shell\n   sudo rpm -e gpg-pubkey-75716059-63172e8a\n   # or\n   sudo rpm -e gpg-pubkey-2c6106201985b60e6c7ac87323f3d4ea75716059-63172e8a\n   ```\n3. Then remove and reinstall `gh`:\n   ```shell\n   sudo dnf remove gh\n   sudo dnf install gh\n   ```\n   (Replace `dnf` with `yum` or `zypper` as appropriate.)\n\n\n## \u003ca id=\"background\">Background\u003c/a>\n\nIn September 2024, [our PGP signing key expired (#9569)](https://github.com/cli/cli/issues/9569), disrupting Linux package installs and updates. At that time, we extended the expiration of the existing key as an emergency fix.\n\nThis time, we are proactively rotating to a brand-new key well ahead of the expiry date. The updated keyring files (binary [`.gpg`](https://cli.github.com/packages/githubcli-archive-keyring.gpg) and ASCII armored [`.asc`](https://cli.github.com/packages/githubcli-archive-keyring.asc)) already contain both the old and new keys, so anyone who has installed `gh` following our [Linux installation instructions](https://github.com/cli/cli/blob/trunk/docs/install_linux.md) since April 8, 2026, is already covered.\n\n## \u003ca id=\"final-notes\">Final notes\u003c/a>\n\nWe apologize for any inconvenience this may cause. By announcing well in advance, we hope to give everyone enough time to update their keyring before the old key expires.\n\nIf you run into any problems, please follow up on this issue and we'll do our best to help.\n\nThank you for your patience and for using GitHub CLI!\n","author":{"url":"https://github.com/babakks","@type":"Person","name":"babakks"},"datePublished":"2026-04-08T15:10:37Z","url":"https://github.com/cli/cli/issues/13118"}