GPG key used to sign GitLab package repositories' metadata has been extended (opens in new tab)
GitLab has extended the expiration date of the GPG key used to sign metadata for its APT and YUM repositories. The key, fingerprint `F640 3F65 44A3 8863 DAA0 B6E0 3F01 618A 5131 2F3F`, now expires on February 6, 2028, rather than February 27, 2026. Existing users may need to refresh the key, while new users can follow the standard GitLab installation instructions. ## Purpose of the Signing Key - GitLab uses GPG signatures to protect repository metadata for: - `omnibus-gitlab` packages - `gitlab-runner` packages - Repository metadata signing is separate from package signing. - The key’s expiration is periodically extended to follow security policies and reduce exposure if it is compromised. ## Required Actions - Users who configured GitLab repositories before February 17, 2026, should follow GitLab’s documentation to fetch and install the updated key. - New users do not need special steps beyond following the GitLab or GitLab Runner installation guides. - The public key can be retrieved: - From GPG keyservers using the fingerprint or associated email address - Directly at `https://packages.gitlab.com/gpg.key` ## Getting Help - Documentation explains how to verify repository metadata signatures. - Additional issues should be reported in the `omnibus-gitlab` issue tracker. Users with existing GitLab package repositories should refresh their trusted GPG key to avoid future signature-validation problems.