GitHub CLI Linux package signing key expires September 5
The current PGP key for the GitHub CLI Linux package repositories expires on Saturday, September 5, 2026.
The GitHub CLI's PGP key for Linux package repositories expires on Saturday, September 5, 2026. After that, APT and RPM repository metadata, and newly published RPM packages, will be signed only with the replacement key, which GitHub published in a combined keyring back in April.
- If gh was installed from the official APT or RPM repositories before April 8, 2026, and the setup hasn't been updated since, follow the instructions in the full announcement before September 5.
- If it was installed after that date, or the install method isn't certain, or a custom image or automation path is used, follow the announcement's steps to verify the system trusts the replacement key.
This does not affect Windows or macOS users, anyone building from source, installs via Homebrew, Conda, or a community package manager, or a direct .deb file or standalone archive binary from GitHub Releases.
GitHub
Where the world builds software — Git hosting, pull requests, issues, Actions CI/CD, and Copilot, free for public and private repos.
View GitHub →