Hi all! I noted this morning that since 2026-09-09 apt.releases.hashicorp com has a new signing key in use and I would like confirmation that it is genuine before we roll it out to our fleet. apt.releases.hashicorp com/gpg now serves key FC9CA96ACA026560, fingerprint D55C 0D1A C78A 8D81 26CB 631C…

Yes, can somebody please confirm this new key is the expected key? Our builds are broken and I can’t fix this until we know the new key is legit and not another attack.

Same issue, any official communication on that?

Hashicorp Linux packages GPG key rotation - HashiCorp Services Status Our Engineering team has implemented a fix to resolve the issue. We are monitoring the situation closely and will post an update as soon as the issue is fully resolved.

The repo metadata and packages on rpm.releases.hashicorp.com for Amazon Linux aarch64 have not been re-signed or re-indexed since August 27, 2026. As a result, the repo config points to the new GPG key (0xCA026560), but the available RPM package (terraform-1.16.0-1.aarch64.rpm) remains signed with t…

This should be fixed, please update this Discuss thread if you are still seeing this problem. Thanks!

Is the new apt.releases.hashicorp.com signing key (FC9CA96ACA026560) legitimate?

Consul

sysadmins September 10, 2026, 3:33pm 3

See updates on: HCSEC-2026-33 - HashiCorp Linux Signing GPG Key Update (CA026560)

Topic		Replies	Views
HCSEC-2026-33 - HashiCorp Linux Signing GPG Key Update (CA026560) Security	0	1840	September 10, 2026
[Resolved] Debian Repo - Apt Update Fails, New GPG Keys Terraform	19	20077	March 29, 2023
HCSEC-2026-03 - HashiCorp GPG Key (72D7468F) Update Security	0	2754	March 12, 2026
HCSEC-2022-11 - HashiCorp GPG Signing Subkey Change Security	0	4604	April 18, 2022
Bad signature for https://apt.releases.hashicorp.com/dists/focal/InRelease Terraform	11	5452	March 15, 2023

Is the new apt.releases.hashicorp.com signing key (FC9CA96ACA026560) legitimate?

Related topics