Proactive Steps for GitHub CLI Users: Avoiding PGP Key Issues and Maintaining Software Developer Metrics

Proactive Steps for GitHub CLI Users: Avoiding PGP Key Issues and Maintaining Software Developer Metrics

As developers, we rely on robust tools and seamless workflows to maintain high software developer metrics and productivity. An upcoming change for GitHub CLI Linux users highlights the importance of staying ahead of system maintenance to prevent disruptions.

GitHub has announced a critical PGP signing key rotation for its CLI Linux packages. The current key, used to verify packages and repository metadata, is set to expire on September 5, 2026. While this date might seem distant, proactive steps are crucial to ensure uninterrupted package installations and updates.

Who is Affected?

This change primarily impacts Linux users who installed GitHub CLI through the official APT or RPM package repositories before April 8, 2026 and have not yet refreshed their repository configuration or keyring. If you installed GitHub CLI using the official instructions after April 8, 2026, you likely already have the new key and do not need to take action.

Installations from other sources, such as Homebrew, GitHub Releases, community package managers, or source code, are not affected by this specific key rotation.

The Solution: Update Your Keyring

To prevent package installation and update failures, affected users need to update their keyring. GitHub has already published the new signing key, and the updated keyring has contained both the old and new keys since April 8, 2026. This means the necessary components are already available; it's a matter of ensuring your system fetches and trusts them.

The definitive source for instructions, to confirm if you are affected, and to find steps for updating your keyring is the GitHub CLI PGP key rotation announcement [September 2026]. We highly recommend consulting this official guide for precise, up-to-date instructions tailored to your specific Linux distribution and package manager.

Recognizing the Problem: Common Error Messages

If you miss the September 5, 2026 deadline without updating your keyring, your package manager may fail to verify the authenticity of GitHub CLI packages. This can manifest in various error messages, indicating expired or unknown PGP keys. Here are some examples you might encounter:

W: Failed to fetch https://cli.github.com/packages/dists/stable/InRelease
The following signatures were invalid: EXPKEYSIG 23F3D4EA75716059 GitHub CLI
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 5612B36462313325

Transaction failed: Signature verification failed. OpenPGP check for package ... from repo "gh-cli" has failed: Import of the key didn't help, wrong key?

The GPG keys listed for the "packages for the GitHub CLI" repository are already installed but they are not correct for this package. Check that the correct key URLs are configured for this repository.. Failing package is: gh... GPG Keys are configured as: https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x23F3D4EA75716059 ... Error: GPG check FAILED

Warning: File 'repomd.xml' from repository 'packages for the GitHub CLI' is signed with an unknown key '5612B36462313325' ... Warning: We can't verify that no one meddled with this file, so it might not be trustworthy anymore! You should not continue unless you know it's safe. ... Repository 'packages for the GitHub CLI' is invalid. [gh-cli|https://cli.github.com/packages/rpm] Valid metadata not found at specified URL History: - Signature verification failed for repomd.xml - Can't provide /repodata/repomd.xml

error: Verifying a signature using certificate 2C6106201985B60E6C7AC87323F3D4EA75716059 (GitHub CLI ): 1. Certificate 23F3D4EA75716059 invalid: certificate is not alive because: The primary key is not live because: Expired on 2026-09-05T12:44:10Z 2. Key 23F3D4EA75716059 invalid: key is not alive because: The primary key is not live because: Expired on 2026-09-05T12:44:10Z

Encountering these errors can halt your development process, impacting your team's performance metrics and overall efficiency. By addressing this key rotation proactively, you ensure that your GitHub CLI installations remain secure and functional, contributing positively to your engineering quality metrics through reliable toolchains.

Don't wait until the last minute. Take a moment to review your GitHub CLI installation and update your keyring if necessary. A small effort now can save significant troubleshooting time later.