When does the GitHub CLI Linux signing key expire?

The current PGP key for GitHub CLI APT and RPM repositories expires on Saturday, September 5, 2026. Beginning with the first release after that date, repository metadata and new RPM packages are signed only with the replacement key.

Who needs to act on the GitHub CLI key expiry?

Anyone who installed gh from the official APT or RPM repositories before April 8, 2026 and has not updated the setup since should verify their keyring trusts the replacement key. Users of Windows, macOS, Homebrew, Conda, source builds, direct .deb files, and standalone archives are unaffected.

What happens if my keyring is missing the replacement key?

After September 5, APT and RPM operations will fail signature verification because repository metadata and new RPM packages use only the replacement key. Update the keyring now to avoid broken installs and CI pipelines.

GitHub CLI Linux Package Signing Key Expires September 5

What shipped

The current PGP signing key for the GitHub CLI Linux package repositories expires Saturday, September 5, 2026. It's a deprecation notice, not a release.

What changed

After expiry, APT and RPM repository metadata and newly published RPM packages will be signed with only the replacement key. If you installed gh from official APT/RPM repos before April 8, 2026 and haven't refreshed the setup, your keyring may not trust the replacement — follow GitHub's announcement steps before September 5. Anyone using a keyring published since April already has both keys. Unaffected: Windows/macOS, source builds, Homebrew, Conda, direct .deb files, and standalone archives.

Why a builder cares

Two days of runway. CI images, Dockerfiles, and Ansible roles that bootstrapped gh before April 8 will silently fail signature checks on the next apt update or yum install after the key rotates — verify now, not when the pipeline breaks.

What shipped

What changed

Why a builder cares

Related posts