Update: Mostly resolved. Main security page lists both updated and rotated key fingerprints, PRs in place to update remaining docs. Just pull the new keys, as per the regular installation docs for your specific tool.
I was running my apt update this morning (as one does on Mondays) and got a complete failure due to the the Debian GPG signing key rotation for Hashicorp. When I pulled the latest key from Hashicorp servers, I could not find any reference to the fingerprint in the docs. Here is what I got
798A EC65 4E5C 1542 8C8E 42EE AA16 FCBC A621 E701
Here is where I looked for key fingerprints.
I assume that those docs are being updated rapidly, but this requires urgent attention. Users cannot run apt update until resolved. User path is:
apt update
fails due to GPG mismatch
one of the following:
A. user deletes/disables repo
B. user finds non-specific guide to use apt-key
C. user finds Hashicorp docs
Hashicorp docs do not show new fingerprint yet, alarming
Just want to start a public thread, since I am probably not the only one with this issue.
Iām seeing a similar issue with the AmazonLinux yum repos.
Public key for terraform-1.3.7-1.x86_64.rpm is not installed
(3/3): terraform-1.3.7-1.x86_64.rpm | 13 MB 00:00:01
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total 2.9 MB/s | 14 MB 00:00:04
Retrieving key from https://rpm.releases.hashicorp.com/gpg
Invalid GPG Key from https://rpm.releases.hashicorp.com/gpg: No key found in given key data
A similar issue happens if I try to import the GPG key manually:
bash-4.2# rpm --import https://rpm.releases.hashicorp.com/gpg
error: https://rpm.releases.hashicorp.com/gpg: key 1 not an armored public key.
The fingerprint must match 798A EC65 4E5C 1542 8C8E 42EE AA16 FCBC A621 E701 , which can also be verified at Security at HashiCorp under āLinux Package Checksum Verificationā. Please note that there was a previous signing key used prior to January 23, 2022, which had the fingerprint E8A0 32E0 94D8 EB4E A189 D270 DA41 8C88 A321 9F7B . Details about this change are available at HashiCorp Services Status - Scheduled Maintenance | APT Repository.
Still showing the old fingerprint in the docs - I guess thereās more updates needed:
The fingerprint must match E8A0 32E0 94D8 EB4E A189 D270 DA41 8C88 A321 9F7B, which can also be verified at Security at HashiCorp under āLinux Package Checksum Verificationā.
(This is at Install Vault | Vault | HashiCorp Developer which is where the vault documentation took me when I clicked āInstallationā and then the ātutorialā link under āLinux package managerā)
Hey- Thanks for the report. This has been updated at Official Packaging Guide and is reflected on the security page. Let us know if you see any other lingering references to the old fingerprint. Thanks!
Err:3 https://apt.releases.hashicorp.com jammy InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA418C88A3219F7B
I thought I was crazy for the past hour until I see the replies here now. Definitely something wrong with the repos because yesterday this was fine as I was doing vagrant install on a new instance. Today is not when I am doing one more new install. the signature checked fine compared to the latest documentation.
Reading package lists...
W: GPG error: https://apt.releases.hashicorp.com focal InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY DA418C88A3219F7B
E: The repository 'https://apt.releases.hashicorp.com focal InRelease' is not signed.
Error: Process completed with exit code 100.
DA418C88A3219F7B (fingerprint E8A032E094D8EB4EA189D270DA418C88A3219F7B) is in fact actually the old key before it was rotated last month.
Not sure why suddenly it is being used again (to be fair itās scheduled to be revoked on 24th April 2023), so I guess we should still trust the old gpg key (again)?
Iām sorry for the late response. Unfortunately the folks who commonly monitor this forum are mostly in the Pacific timezone and so Iām only just getting online now.
The team which maintains the APT repository has been working on it and it should now be back to functioning correctly again.
I guess thatās one of the reasons why Debian/Ubuntu switch to keyring files (referenced via āsigned-byā in sources.list), as they can easily be managed by a package after initial setup.
