Repository navigation
fix(security): refresh the expired vendor signing keys - #210
Merged
Merged
Conversation
security/hashicorp.asc had lapsed on 2026-04-18, and nothing said so: gpg --verify returns exit 0 for a good signature made by an expired key, so every Terraform download kept verifying and the build kept passing while the expiry bound had quietly gone. The key still in use, re-fetched from the vendor, now carries a self-signature valid to 2030-03-01. Same key, later expiry: the primary fingerprint is unchanged (C874011F0AB405110D02105534365D9472D7468F), so the trust root does not move. Verified before committing — every SHA256SUMS signature in security/ still reports a good signature under the refreshed copy and no longer warns expired, including the 1.15.9 and 1.16.3 material added in #205. The one signing subkey that expired in 2022 is a rotated historical subkey and is carried by the vendor's own copy. security/awscliv2.asc is expired too, since 2023-09-17, and is not fixed here: AWS publishes its key only in the install guide, and that host is unreachable from a hosted session. It needs the maintainer.
This was referenced Sep 21, 2026
security/awscliv2.asc had lapsed on 2023-09-17, three years, and failed silently the same way the HashiCorp key did: gpg --verify returns exit 0 for a good signature made by an expired key, so every AWS CLI download kept verifying and nothing reported that the expiry bound had gone. Same key, later expiry: the primary fingerprint is unchanged (FB5DB77FD5C118B80511ADA8A6310ACC4672475C), so the trust root does not move; the self-signature now runs to 2027-07-01. Taken from the CLI install guide, the only place AWS publishes it. Verified before committing: the committed signatures for 2.36.49 on both published architectures report a good signature under the refreshed copy and no longer warn expired, checked against the real archives downloaded from awscli.amazonaws.com. The repo's copy was two generations behind. 2023-09-17, then the keyserver's 2026-07-07, now 2027-07-01.
bgauduch
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Both keys under
security/had lapsed, and neither failure was visible:gpg --verifyexits 0 for a good signature made by an expired key, so every download kept verifying while the expiry bound was gone.hashicorp.ascC874011F0AB405110D02105534365D9472D7468F, unchangedawscliv2.ascFB5DB77FD5C118B80511ADA8A6310ACC4672475C, unchangedSame keys, later expiries — neither trust root moves. Sources: HashiCorp's
/.well-known/pgp-key.txt, and the CLI install guide for AWS, the only place it publishes one. The AWS copy was two generations behind: 2023-09-17, then the keyserver's 2026-07-07, now 2027-07-01.Verified before pushing: every
SHA256SUMSsignature undersecurity/(1.14.9, 1.15.9, 1.16.3) and both published architectures' AWS CLI signatures for 2.36.49 report a good signature under the refreshed keys and no longer warnexpired— the AWS archives downloaded fromawscli.amazonaws.comfor the check.validate.sh --fastgreen;build-testgreen on the full matrix.Unblocks #211, whose check now reports
PASS vendor keys in security/ are unexpired (earliest 2027-07-01).Roadmap phase / closes: Phase 3 — closes #106 P0 action 2
Breaking change
None.
Architecture Decision Record
docs/adr/(link: ____)Key material only; no policy change.
Checklist