Skip to content
Snippets Groups Projects
package_signatures.md 8.51 KiB
stage: Systems
group: Distribution
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments

Linux package signatures

DETAILS: Tier: Free, Premium, Ultimate Offering: Self-managed

We use a packagecloud instance at https://packages.gitlab.com to share the different OS packages we offer.

The instance uses various cryptographic methods to ensure the integrity of these packages.

Package repository metadata signing keys

The APT and YUM repositories on the packagecloud instance use a GPG key to sign their metadata. This key is automatically installed by the repository setup script specified in the installation instructions.

Current signing key

Key attribute Value
Name GitLab B.V.
EMail packages@gitlab.com
Comment package repository signing key
Fingerprint F640 3F65 44A3 8863 DAA0 B6E0 3F01 618A 5131 2F3F
Expiry 2026-02-27

This key is active from 2020-04-06.

The key's expiry was extended from 2024-03-01 to 2026-02-27. If you encounter an expiration of 2024-03-01, follow the instructions below.

::Tabs

:::TabTitle Debian-based distributions

packagecloud made used apt-key, which is deprecated . Manually installed or configured repositories from some distributions, such as TurnKey Linux, are already using the signed-by support in Debian package source lists.

  1. Determine if you're using apt-key or signed-by:

    grep 'deb \[signed-by=' /etc/apt/sources.list.d/gitlab_gitlab-?e.list

    If this command:

    • Returns any lines, you're using signed-by, which takes precedence over apt-key.
    • No lines, you're using apt-key.
  2. If using signed-by, run this script as root to update the public keys for GitLab repositories:

    awk '/deb \[signed-by=/{
          pubkey = $2;
          sub(/\[signed-by=/, "", pubkey);
          sub(/\]$/, "", pubkey);
          print pubkey
        }' /etc/apt/sources.list.d/gitlab_gitlab-?e.list | \
      while read line; do
        curl -s "https://packages.gitlab.com/gpg.key" | gpg --dearmor > $line
      done
  3. If using apt-key, run this script as root to update the public keys for GitLab repositories:

    apt-key del 3F01618A51312F3F
    curl -s "https://packages.gitlab.com/gpg.key" | apt-key add -
    apt-key list 3F01618A51312F3F

:::TabTitle RPM-based distributions

YUM and DNF have small differences, but the underlying configuration is identical:

  1. Remove any existing key from the repository keyrings:

    for pubring in /var/cache/dnf/*gitlab*/pubring
    do
      gpg --homedir $pubring --delete-key F6403F6544A38863DAA0B6E03F01618A51312F3F
    done
  2. Update the repository data and cache, which asks you to confirm keys:

    dnf check-update

::EndTabs

Fetch latest signing key