# GitHub CLI’s Linux package signing key expires September 5 GitHub CLI users who install `gh` through apt, yum or dnf need GitHub’s replacement package-signing keyring before September 5 unless they have already refreshed their repository setup since April. The CLI itself is not being deprecated. The risk is narrower and operational: stale Linux repository keyrings can stop package installs or updates from verifying after the old signing key expires. - Status: Active - Published: 2026-09-04T10:14:55+12:00 - Updated: 2026-09-04T10:14:55+12:00 - Categories: Web Development, Developer Tools - Tags: GitHub, GitHub CLI, Linux, migration, package signing, PGP - Canonical HTML: https://beyondthe.news/dossiers/github-cli-linux-package-signing-key-expiry-september-5-2026 ## What changed GitHub’s existing PGP signing key for GitHub CLI Linux package repositories expires on September 5, 2026. GitHub published a replacement keyring in April containing both the old and new keys and is now reminding Linux package-manager users to refresh before the cutoff. Anyone who has rerun GitHub’s Linux installation steps since the new keyring was published is already covered. The change affects `gh` installed or updated through apt, yum or dnf; Windows, macOS, Homebrew, Conda, precompiled binaries and source builds are not affected by this repository-key rollover. ## Why it matters Repository signing failures often surface as a broken update path rather than an obvious application failure. CI images, developer workstations and long-lived servers that configured GitHub CLI months ago can continue running their existing binary while silently carrying the old keyring, then fail the next package update after September 5. The fix is small, but the cutoff is immediate and easy to miss because it lives in package-repository configuration rather than the CLI release itself. ## The expiration affects repository verification, not the installed CLI An existing `gh` binary does not stop working when the PGP key expires. The problem appears when apt, yum or dnf tries to verify package metadata or a new package using repository trust material that has not been refreshed. ## Rerunning GitHub’s distro setup picks up the new keyring GitHub’s replacement keyring includes the new signing key. Users who refreshed their Linux installation configuration after April 8 already have it; older installations should repeat the current repository setup steps for their distribution. ## Many common installation paths are outside the blast radius GitHub says the rollover does not affect Windows or macOS installs, source builds, Homebrew, Conda or precompiled binaries. Teams should therefore identify how `gh` is installed before applying a fleet-wide remediation. ## Key details - The old GitHub CLI Linux package signing key expires September 5, 2026. - GitHub published a replacement keyring on April 8 containing both the current and replacement keys. - Users who reran GitHub’s Linux installation steps after the new keyring appeared are already covered. - Affected package managers are apt, yum and dnf. - The issue concerns future package verification/updates rather than the continued execution of an already-installed `gh` binary. - Windows, macOS, Homebrew, Conda, source builds and precompiled binaries are unaffected by this key rollover. ## Builder takeaways - Check how `gh` is installed in developer images, CI runners and long-lived Linux hosts before the September 5 cutoff. - Refresh GitHub’s repository/keyring setup using the current official distro instructions rather than copying a key from an old internal script. - Update base images and bootstrap scripts as well as individual machines so a rebuilt environment does not reintroduce the expired key. - Do not treat a working `gh --version` as proof that the package repository is healthy; test the package-manager metadata/update path. ## What to watch - Any post-expiry package-manager errors from installations that missed the keyring refresh. - Whether old container images or infrastructure bootstrap scripts continue installing the expired key. - Future GitHub CLI signing-key rotations and whether repository packages automate trust-key rollover more completely. ## Uncertainties - The practical failure message varies by Linux distribution and package manager. - Hosts that do not update `gh` immediately after September 5 may not reveal the stale keyring until a later package operation. ## Sources - [GitHub CLI Linux package signing key expires September 5](https://github.blog/changelog/2026-09-03-github-cli-linux-package-signing-key-expires-september-5) — GitHub Changelog · primary · 2026-09-03T00:00:00+12:00. Current deadline reminder and affected installation paths. - [New PGP signing key for GitHub CLI Linux packages](https://github.blog/changelog/2026-04-08-new-pgp-signing-key-for-github-cli-linux-packages/) — GitHub Changelog · primary · 2026-04-08T00:00:00+12:00. Original replacement-key announcement and remediation guidance.