GitHub Changelog first-party post · Published 2026-09-04

GitHub CLI’s old Linux signing key has expired

Older installations using GitHub’s official Linux software repositories may need an updated signing key.

GitHub CLI Linux signing-key change: expired key, affected repository setup conditions and installation routes outside the change. — The old key expired September 5, 2026. Installation or updates may be affected when release signing switches, for repository setups meeting all listed conditions. · Open full-size image

Older Linux repository setups need updated signing trust

The old GitHub official Linux repository key expired on September 5, 2026. APT/RPM environments configured before April 8 and not updated need checking; the signing change for later releases may affect installation or updates.

中文

Identify the installation method first

The announcement concerns older signing-trust setups for the official Linux repositories. Windows, macOS, Homebrew and Conda installations are outside its stated scope.

Important additions and corrections

Dates below mark changes to our coverage.

Addition · 06/09/2026, 11:48 Beijing time
Clarified the expiry boundary: it does not immediately disable every old client; the signing change starts with the first new release after expiry.
Addition · 05/09/2026, 22:39 Beijing time
Added the signing-key expiry scope: focus on gh installations using the official APT/RPM repositories; other installation methods need separate consideration.

Sources and notes

sources中文

Sources and notes

Read the originalGitHub Changelog first-party post
GitHub CLI's full official maintenance instructions

Retained summary and context

Older setups using the official APT or RPM repositories should check that the replacement key is installed.

Not all GitHub CLI installations are affected: Windows, macOS, Homebrew and Conda are outside this change. Expiry does not mean every old client immediately fails; new signatures start with the first release after expiry. We have not checked reader environments.

Sources and evidence · 3 links

Each link has a purpose and scope. Link counts do not establish independent confirmation; direct support applies only to the statements specified below.

GitHub Changelog first-party postDirect support
Read the September 3 changelog and full official announcement in issue #13118 for September 5 expiry, the April 8 cutoff, affected repositories, excluded installation methods and the signing transition.
Limits: Past tense follows the announced date and the September 6 review date. We did not confirm that the first post-expiry release had shipped or modify any user machine.
Supporting material
https://github.blog/changelog/2026-09-03-github-cli-linux-package-signing-key-expires-september-5 https://github.com/cli/cli/issues/13118 Full source record (JSON)
GitHub Changelog feed
GitHub CLI's full official maintenance instructionsDirect support
Fingerprints, distribution-specific verification and update steps, and earlier announcement date.
Limits: Example errors are not observed incidents; these steps were not run locally.
Supporting material
https://github.com/cli/cli/issues/13118 Full source record (JSON)

Source timeline

2026-09-05 · Found this reading link via GitHub Changelog.

Collection record

First discovered: 2026-09-05

Collection and source publication have distinct dates.

Editorial record

Sources reviewed

06/09/2026, 11:48 · Beijing time (UTC+8)

Reviewed official materials to clarify purpose, changes and usage conditions, distinguishing source descriptions from untested results. Original publication and observation dates are retained; an editorial revision is not a new product release.

Sources and full record

This dates our review of the wording and sources, not a project release or product update.

Full record: before, after and sources (JSON)

Previous source review (JSON)

Corrections and feedback