{
  "schemaVersion": "bitshovel-editorial-review-v1",
  "id": "r131-github-cli-signing-key-decision-20260905",
  "signalId": "feed-story-github-blog-changelog-2026-09-03-github-cli-linux-pa-36fb2206399fd4d1",
  "originalUrl": "https://github.blog/changelog/2026-09-03-github-cli-linux-package-signing-key-expires-september-5",
  "kind": "evidence-review",
  "reviewedAt": "2026-09-05T14:39:14.930Z",
  "before": {
    "id": "feed-story-github-blog-changelog-2026-09-03-github-cli-linux-pa-36fb2206399fd4d1",
    "state": "new",
    "lane": "platformShift",
    "publishedAt": "2026-09-03T19:05:40.000Z",
    "observedAt": "2026-09-05T10:03:05.417Z",
    "originalUrl": "https://github.blog/changelog/2026-09-03-github-cli-linux-package-signing-key-expires-september-5",
    "relatedSources": [
      {
        "label": {
          "zh": "GitHub Changelog 频道",
          "en": "GitHub Changelog feed"
        },
        "url": "https://github.blog/changelog/"
      }
    ],
    "source": {
      "zh": "GitHub Changelog 一手发布",
      "en": "GitHub Changelog first-party post"
    },
    "title": {
      "zh": "GitHub CLI 的 Linux 包签名密钥于 9 月 5 日到期",
      "en": "GitHub CLI Linux package signing key expires September 5"
    },
    "summary": {
      "zh": "GitHub Changelog 发布《GitHub CLI Linux package signing key expires September 5》。这是一方信源的新发布，标题与要点来自原文；正文结论请以原文为准。",
      "en": "GitHub Changelog published \"GitHub CLI Linux package signing key expires September 5\". A first-party new post — the line above and the linked original carry the substance."
    },
    "why": {
      "zh": "原文线索，尚未完成具体决策解读。这是一手发布，不是转述。先核对原文的适用对象、实际变化和限制，再判断是否值得试用或调整现有方案。来源收录不代表质量或采用。",
      "en": "A source note awaiting an article-specific decision brief; a first-party post, not a relay. Check who it applies to, what changed, and the limits before deciding whether to trial it or adjust an existing workflow. Collection is not proof of quality or adoption."
    },
    "caveat": {
      "zh": "同窗收录仅证明原文可达；标题与结论均为作者自述或收录源转述，不是 BitShovel 的独立评测，也不能证明质量或采用；围绕它的讨论只是讨论快照式的注意力，不能证明事实成立；国内访问部分原文域名可能不稳定。",
      "en": "Same-window collection proves reachability only. Titles and claims are the creator self-report of the author or the carrying feeds' relay — not an independent BitShovel review, not proof of quality or adoption; the surrounding discussion is a discussion snapshot of attention, and attention is not proof of fact. Some origin domains may be unstable from mainland China."
    },
    "timeline": [
      {
        "date": {
          "zh": "9 月 5 日",
          "en": "Sep 5"
        },
        "kind": "record-added",
        "datetime": "2026-09-05T10:03:05.417Z",
        "summary": {
          "zh": "进入 BitShovel 雷达：GitHub Changelog 一手发布（收录时各源可见 10 条）。",
          "en": "Entered the BitShovel radar: first-party on GitHub Changelog (10 entries visible at collection)."
        },
        "source": {
          "zh": "GitHub Changelog 快照",
          "en": "GitHub Changelog snapshot"
        }
      }
    ],
    "followTarget": {
      "id": "page:github-blog-changelog-2026-09-03-github-cli-linux-pa-36fb2206399fd4d1",
      "label": {
        "zh": "GitHub CLI 的 Linux 包签名密钥于 9 月 5 日到期",
        "en": "GitHub CLI Linux package signing key expires September 5"
      },
      "scope": {
        "zh": "原文页面的后续实质变化：内容修订、数据更新或官方回应",
        "en": "Material follow-up changes on the original page: revisions, data updates, or an official response"
      },
      "url": "https://github.blog/changelog/2026-09-03-github-cli-linux-package-signing-key-expires-september-5",
      "updateMode": "editorial-watch"
    },
    "ingestion": {
      "mode": "editorial",
      "adapter": "syndication-corroborated",
      "evidenceClass": "official-statement",
      "editorialReadiness": "source-note"
    }
  },
  "after": {
    "title": {
      "zh": "GitHub CLI 旧密钥 9 月 5 日到期：核对 APT/RPM 环境",
      "en": "GitHub CLI's old key expires September 5: check APT/RPM environments"
    },
    "summary": {
      "zh": "GitHub CLI 官方 Linux 仓库的旧 PGP 密钥到期日为 2026 年 9 月 5 日。到期后首个版本起，APT/RPM 元数据及新 RPM 包只用替换密钥签名；4 月 8 日已发布含新旧密钥的 keyring。",
      "en": "The old PGP key for GitHub CLI’s official Linux repositories expires September 5, 2026. From the first release after that date, APT/RPM metadata and new RPM packages use only its replacement; a dual-key keyring was published April 8."
    },
    "why": {
      "zh": "通过官方 APT/RPM 安装 gh 的开发者应检查本机、基础镜像和 CI，尤其是 4 月 8 日前配置且未更新的环境。按官方完整公告核对新密钥，再更新对应安装配置，可避免后续安装或更新受阻。",
      "en": "Developers using official APT/RPM repositories should check machines, base images and CI, especially unchanged pre-April 8 setups. Verify the replacement key and update the matching installation configuration using the official instructions."
    },
    "caveat": {
      "zh": "Windows/macOS、源码构建、Homebrew/Conda/社区包和直接下载二进制不在该影响范围。这里没有观察到你的环境故障，也未执行修复；代价是配置检查和镜像维护时间。",
      "en": "Windows/macOS, source builds, Homebrew/Conda/community packages and direct binaries are outside this scope. No failure in your environment was observed and no repair was run; allow configuration and image-maintenance time."
    }
  },
  "editorialReadiness": "decision-brief",
  "withdrawnSources": [],
  "withdrawnTimeline": [],
  "evidence": [
    {
      "type": "retained-official-page",
      "label": {
        "zh": "GitHub CLI 官方密钥到期公告",
        "en": "Official GitHub CLI signing-key expiry notice"
      },
      "url": "https://github.blog/changelog/2026-09-03-github-cli-linux-package-signing-key-expires-september-5",
      "path": "app/_content/editorial-reviews/evidence/r131-github-cli-signing-key-page.json",
      "bytes": 1230,
      "sha256": "365dd8cc5297917801f07932ecb799ee4a3565c09e8232bdfc06dab85a573b5f",
      "fetchedAt": "2026-09-05T11:07:07.791402Z"
    },
    {
      "type": "retained-official-page",
      "label": {
        "zh": "GitHub CLI 官方完整维护说明",
        "en": "GitHub CLI's full official maintenance instructions"
      },
      "url": "https://github.com/cli/cli/issues/13118",
      "path": "app/_content/editorial-reviews/evidence/r131-github-cli-full-announcement-page.json",
      "bytes": 1119,
      "sha256": "4819a61f068899741303e7948c2ced60917e24df3ab51eec6ecbddbcb79bb938",
      "fetchedAt": "2026-09-05T11:09:48.596269Z"
    },
    {
      "type": "retained-feed-entry",
      "label": {
        "zh": "保留的原始发布与发现记录",
        "en": "Retained publication and discovery entry"
      },
      "url": "https://github.blog/changelog/2026-09-03-github-cli-linux-package-signing-key-expires-september-5",
      "fetchedAt": "2026-09-05T10:03:05.417Z",
      "path": "app/_content/editorial-reviews/evidence/r131-github-cli-signing-key-feed-entry.json",
      "bytes": 710,
      "sha256": "1ae5294e7e435d8b048719d4327c6094de91c768e67604a4b9e8f1ac07f462c3",
      "retainedRecord": {
        "sourceSnapshot": "app/_content/source-observations/history/syndication-feeds.2026-09-05T10-03-05Z.snapshot.json",
        "sourceSnapshotSha256": "869b43001d3867238f47d14ab45c67974fa62093b6a78eb57344026054e59c00",
        "observedAt": "2026-09-05T10:03:05.417Z",
        "feedSourceKey": "feed:github-changelog",
        "entry": {
          "id": "https://github.blog/changelog/2026-09-03-github-cli-linux-package-signing-key-expires-september-5",
          "title": "GitHub CLI Linux package signing key expires September 5",
          "url": "https://github.blog/changelog/2026-09-03-github-cli-linux-package-signing-key-expires-september-5",
          "publishedAt": "2026-09-03T19:05:40.000Z",
          "updatedAt": null,
          "author": "Allison"
        }
      }
    }
  ],
  "sourceAssessments": [
    {
      "url": "https://github.blog/changelog/2026-09-03-github-cli-linux-package-signing-key-expires-september-5",
      "role": "direct-support",
      "scope": {
        "zh": "旧密钥日期、签名切换规则及受影响安装方式。",
        "en": "Old-key expiry, signing switch and affected installation methods."
      },
      "limitations": {
        "zh": "不能证明任何特定机器已经出错。",
        "en": "Does not show that a particular machine has failed."
      },
      "evidenceUrls": [
        "https://github.blog/changelog/2026-09-03-github-cli-linux-package-signing-key-expires-september-5"
      ]
    },
    {
      "url": "https://github.com/cli/cli/issues/13118",
      "role": "direct-support",
      "scope": {
        "zh": "新旧指纹、发行版核对和更新步骤，以及早期公告日期。",
        "en": "Fingerprints, distribution-specific verification and update steps, and earlier announcement date."
      },
      "limitations": {
        "zh": "示例错误不是实测事故；未在本机运行这些步骤。",
        "en": "Example errors are not observed incidents; these steps were not run locally."
      },
      "evidenceUrls": [
        "https://github.com/cli/cli/issues/13118"
      ]
    }
  ],
  "note": {
    "zh": "已核对留存的官方正文，补充适用对象、实际变化、行动与限制，形成具体决策解读。发布日期与发现时钟分开保留；核验时间不作为产品新事件，未运行迁移、修复或集成测试。",
    "en": "Retained official pages were reviewed for audience, changes, actions and limits to form a decision brief. Publication and discovery clocks remain distinct; review time is not a new product event. No migration, repair or integration test was run."
  },
  "integrity": "7fc5eba5274e55b5c0257c33c1c1db6970d918eb30ecfd4306918e26a4a69eee"
}