stage: Systems
group: Distribution
info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
Linux package signatures
DETAILS: Tier: Free, Premium, Ultimate Offering: Self-managed
We use a packagecloud instance at https://packages.gitlab.com to share the different OS packages we offer.
The instance uses various cryptographic methods to ensure the integrity of these packages.
Package repository metadata signing keys
The APT and YUM repositories on the packagecloud instance use a GPG key to sign their metadata. This key is automatically installed by the repository setup script specified in the installation instructions.
Current signing key
Key attribute | Value |
---|---|
Name | GitLab B.V. |
packages@gitlab.com |
|
Comment | package repository signing key |
Fingerprint | F640 3F65 44A3 8863 DAA0 B6E0 3F01 618A 5131 2F3F |
Expiry | 2026-02-27 |
This key is active from 2020-04-06.
The key's expiry was extended from 2024-03-01 to 2026-02-27. If you encounter an expiration of 2024-03-01
,
follow the instructions below.
::Tabs
:::TabTitle Debian-based distributions
packagecloud made used apt-key
, which is deprecated
. Manually installed or configured repositories from some distributions, such as TurnKey Linux,
are already using the signed-by
support in Debian package source lists.
-
Determine if you're using
apt-key
orsigned-by
:grep 'deb \[signed-by=' /etc/apt/sources.list.d/gitlab_gitlab-?e.list
If this command:
- Returns any lines, you're using
signed-by
, which takes precedence overapt-key
. - No lines, you're using
apt-key
.
- Returns any lines, you're using
-
If using
signed-by
, run this script as root to update the public keys for GitLab repositories:awk '/deb \[signed-by=/{ pubkey = $2; sub(/\[signed-by=/, "", pubkey); sub(/\]$/, "", pubkey); print pubkey }' /etc/apt/sources.list.d/gitlab_gitlab-?e.list | \ while read line; do curl -s "https://packages.gitlab.com/gpg.key" | gpg --dearmor > $line done
-
If using
apt-key
, run this script as root to update the public keys for GitLab repositories:apt-key del 3F01618A51312F3F curl -s "https://packages.gitlab.com/gpg.key" | apt-key add - apt-key list 3F01618A51312F3F
:::TabTitle RPM-based distributions
YUM and DNF have small differences, but the underlying configuration is identical:
-
Remove any existing key from the repository keyrings:
for pubring in /var/cache/dnf/*gitlab*/pubring do gpg --homedir $pubring --delete-key F6403F6544A38863DAA0B6E03F01618A51312F3F done
-
Update the repository data and cache, which asks you to confirm keys:
dnf check-update
::EndTabs