chore: sign APT repository with both keys by babakks · Pull Request #13271 · cli/cli

babakks · 2026-04-23T11:37:57Z

Summary

Updates the deployment workflow to sign the Linux APT repository with both the old and new PGP keys, enabling a smooth key rotation for APT users. The RPM repository continues to be signed with the current key.

Changes

Import and preset the new PGP key alongside the existing key during release
Update script/distributions to dual-sign all APT distributions with both keys
Pin --default-key on the RPM repomd.xml signing step to explicitly use the current key (avoids ambiguity with two keys in the keyring)
Switch script/rpmmacros from email-based UID to explicit fingerprint for the same reason

Copilot

Pull request overview

Updates the release/deployment pipeline to support APT repository key rotation by signing APT metadata with both the existing and new PGP keys, while ensuring RPM signing continues to use the current key explicitly.

Changes:

Import and preset an additional (new) GPG key/passphrase in the production deployment workflow.
Configure reprepro distributions to sign APT repos with both key fingerprints.
Pin RPM metadata signing to an explicit --default-key and update RPM macros to use an explicit fingerprint.

Show a summary per file

File	Description
`script/rpmmacros`	Switches RPM signing identity from email-based UID to an explicit key fingerprint to avoid ambiguity.
`script/distributions`	Updates all APT distributions to sign with both the old and new key fingerprints for rotation.
`.github/workflows/deployment.yml`	Imports/presets the new key in production and pins RPM `repomd.xml` signing to the current key fingerprint.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 3/3 changed files
Comments generated: 0

babakks · 2026-04-23T11:50:53Z

@@ -1 +1 @@
-%_gpg_name GitHub CLI <opensource+cli@github.com>
+%_gpg_name 2C6106201985B60E6C7AC87323F3D4EA75716059


This is changed from identity to the key fingerprint as both our keys share the same identity (name and email), and we want to keep signing our RPM repos with the current key.

babakks · 2026-04-23T11:51:41Z

 cp -r dist/repodata site/packages/rpm/
 pushd site/packages/rpm
- [ "$GPG_SIGN" = "false" ] || gpg --yes --detach-sign --armor repodata/repomd.xml
+ [ "$GPG_SIGN" = "false" ] || gpg --yes --detach-sign --armor --default-key 2C6106201985B60E6C7AC87323F3D4EA75716059 repodata/repomd.xml


The --default-key makes it clear for gpg to use the current key for signing our RPM repo metadata.

babakks · 2026-05-13T12:02:31Z

 Components: main
 Description: The GitHub CLI - debian stable repo
-SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059
+SignWith: 2C6106201985B60E6C7AC87323F3D4EA75716059 7F38BBB59D064DBCB3D84D725612B36462313325


reprepro supports multiple keys in SignWith: value (See here):
2010-01-27
SignWith can take multiple arguments to denote multiple keys to sign a repository with.
It also supports script overrides, e.g. SignWith: ! path/to/script (See here).

williammartin

Looks right to me. I know there's more conversation going on elsewhere.

We're going to sign our APT repository with both keys, but keep the RPM repository and artifacts signed with the currently used key. Signed-off-by: Babak K. Shandiz <babakks@github.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.97.0` → `v2.98.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.98.0`](https://github.com/cli/cli/releases/tag/v2.98.0): GitHub CLI 2.98.0 [Compare Source](cli/cli@v2.97.0...v2.98.0) #### Security A security vulnerability has been identified, and fixed, that binds the local forwarded port to all available network interfaces by default. Users of `gh codespace ports forward` are advised to update `gh` to version `v2.98.0` as soon as possible. For more information see: <GHSA-vfhh-p7hm-pxfh> #### Support worktrees in `pr checkout` Users can now checkout a pull request into a git worktree by using the new `--worktree PATH` flag in `gh pr checkout`: ```shell gh pr checkout 12 --worktree ../wt-feature ``` #### Add semantic search to `search issues` The `gh search issues` command now supports semantic search for issues. Users can select the search type by passing the `--search-type` flag: ```shell gh search issues --search-type semantic ... gh search issues --search-type hybrid ... ``` For more information about semantic search see: ["Improved Search for github issues is now generally available"](https://github.blog/changelog/2026-04-02-improved-search-for-github-issues-is-now-generally-available/). #### What's Changed ##### ✨ Features - Add --worktree flag to gh pr checkout by [@tidy-dev](https://github.com/tidy-dev) in [#13946](cli/cli#13946) - Set GH\_EXTENSION=1 when gh invokes an extension by [@williammartin](https://github.com/williammartin) in [#14072](cli/cli#14072) - Add --search-type flag for semantic and hybrid issue search by [@michaeljacholke](https://github.com/michaeljacholke) in [#14006](cli/cli#14006) ##### 🐛 Fixes - Fix `RESTWithNext` error type, repairing `gh status` and attestation retries by [@williammartin](https://github.com/williammartin) in [#13988](cli/cli#13988) - Trim spaces when parsing X-Oauth-Scopes in `gh release create` by [@williammartin](https://github.com/williammartin) in [#14065](cli/cli#14065) - Fix project item-add output for non-TTY by [@zwick](https://github.com/zwick) in [#14056](cli/cli#14056) ##### 📚 Docs & Chores - Slim down dependabot triage comments by [@williammartin](https://github.com/williammartin) in [#14019](cli/cli#14019) - Require explicit MR review ownership by [@williammartin](https://github.com/williammartin) in [#14028](cli/cli#14028) - Collapse spam triage into the agentic issue-triage workflow by [@williammartin](https://github.com/williammartin) in [#14027](cli/cli#14027) - Run Dependabot triage every hour by [@sergiou87](https://github.com/sergiou87) in [#14030](cli/cli#14030) - Route deploy key requests through api.Client by [@williammartin](https://github.com/williammartin) in [#13989](cli/cli#13989) - Route ssh key requests through api.Client by [@williammartin](https://github.com/williammartin) in [#13994](cli/cli#13994) - Route gpg key requests through api.Client by [@williammartin](https://github.com/williammartin) in [#13997](cli/cli#13997) - Route autolink requests through api.Client by [@williammartin](https://github.com/williammartin) in [#14013](cli/cli#14013) - Route extension requests through api.Client by [@williammartin](https://github.com/williammartin) in [#14059](cli/cli#14059) - Route release creation through api.Client by [@williammartin](https://github.com/williammartin) in [#14062](cli/cli#14062) - Tell agents to use the MR template in AGENTS.md by [@williammartin](https://github.com/williammartin) in [#14074](cli/cli#14074) - Make Dependabot triage cheaper and more decisive by [@williammartin](https://github.com/williammartin) in [#14079](cli/cli#14079) - Route release deletions through api.Client by [@williammartin](https://github.com/williammartin) in [#14077](cli/cli#14077) - Give Dependabot triage a real reachability check by [@williammartin](https://github.com/williammartin) in [#14087](cli/cli#14087) - Restore automatic spam issue closure by [@williammartin](https://github.com/williammartin) in [#14088](cli/cli#14088) - Add a scheduled tech debt burndown skill by [@williammartin](https://github.com/williammartin) in [#14095](cli/cli#14095) - Use reflect.Pointer instead of deprecated reflect.Ptr by [@williammartin](https://github.com/williammartin) in [#14098](cli/cli#14098) - Clarify what belongs in the MR template's testing section by [@williammartin](https://github.com/williammartin) in [#14103](cli/cli#14103) - Rename cli-code-reviewer skill to code-review by [@BagToad](https://github.com/BagToad) in [#14116](cli/cli#14116) - Add aw-actions group to dependabot configuration by [@babakks](https://github.com/babakks) in [#14123](cli/cli#14123) - Isolate tests from local machine's auth and git configuration by [@BagToad](https://github.com/BagToad) in [#14128](cli/cli#14128) - Don't ask for feature detection cleanup comments when not needed by [@babakks](https://github.com/babakks) in [#14139](cli/cli#14139) - Accept pre-release tags in deployment validation by [@BagToad](https://github.com/BagToad) in [#14193](cli/cli#14193) - ci: add temporary step to verify Linux repo signing keys by [@babakks](https://github.com/babakks) in [#14202](cli/cli#14202) - Revert "ci: add temporary step to verify Linux repo signing keys" by [@babakks](https://github.com/babakks) in [#14203](cli/cli#14203) - Fix issue triage action compatibility \[skip changelog] by [@tidy-dev](https://github.com/tidy-dev) in [#14207](cli/cli#14207) #####

Dependencies - chore(deps): bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#14047](cli/cli#14047) - chore(deps): bump the codeql-actions group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#14049](cli/cli#14049) - chore(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#14048](cli/cli#14048) - chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by [@dependabot](https://github.com/dependabot)\[bot] in [#14066](cli/cli#14066) - chore(deps): bump actions/attest from 4.2.1 to 4.2.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#14100](cli/cli#14100) - chore(deps): bump azure/login from 3.0.0 to 3.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#14101](cli/cli#14101) - chore(deps): bump the codeql-actions group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#14091](cli/cli#14091) - chore(deps): bump github/gh-aw-actions/setup-cli from 0.83.4 to 0.85.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#14068](cli/cli#14068) - chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by [@dependabot](https://github.com/dependabot)\[bot] in [#14119](cli/cli#14119) - chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by [@dependabot](https://github.com/dependabot)\[bot] in [#14120](cli/cli#14120) - chore(deps): bump the aw-actions group with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#14147](cli/cli#14147) - chore: sign APT repository with both keys by [@babakks](https://github.com/babakks) in [#13271](cli/cli#13271) - chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 by [@dependabot](https://github.com/dependabot)\[bot] in [#14029](cli/cli#14029) - chore(deps): bump actions/attest from 4.2.0 to 4.2.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#14050](cli/cli#14050) - Bump golangci-lint in CI to v2.12.2 by [@williammartin](https://github.com/williammartin) in [#14102](cli/cli#14102) - chore(deps): bump the aw-actions group with 2 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#14124](cli/cli#14124) - chore(deps): bump google.golang.org/protobuf from 1.36.11 to 1.36.12 by [@dependabot](https://github.com/dependabot)\[bot] in [#14140](cli/cli#14140) - Upgrade gh-aw workflows to v0.85.4 by [@tidy-dev](https://github.com/tidy-dev) in [#14141](cli/cli#14141) - Bump Go to 1.26.6 by [@github-actions](https://github.com/github-actions)\[bot] in [#14143](cli/cli#14143) - chore: bump go to 1.26.7 by [@babakks](https://github.com/babakks) in [#14205](cli/cli#14205) - chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#14204](cli/cli#14204) - chore(deps): bump the codeql-actions group across 1 directory with 3 updates by [@dependabot](https://github.com/dependabot)\[bot] in [#14169](cli/cli#14169) - chore(deps): bump golang.org/x/crypto from 0.54.0 to 0.55.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#14164](cli/cli#14164) - chore(deps): bump charm.land/lipgloss/v2 from 2.0.5 to 2.0.6 by [@dependabot](https://github.com/dependabot)\[bot] in [#14166](cli/cli#14166) - Bump gh-aw-actions to v0.87.1 and recompile agentic workflows by [@BagToad](https://github.com/BagToad) in [#14210](cli/cli#14210) #### New Contributors - [@sergiou87](https://github.com/sergiou87) made their first contribution in [#14030](cli/cli#14030) - [@michaeljacholke](https://github.com/michaeljacholke) made their first contribution in [#14006](cli/cli#14006) **Full Changelog**: <cli/cli@v2.97.0...v2.98.0> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

CopilotAI review requested due to automatic review settings April 23, 2026 11:37

babakks requested a review from a team as a code owner April 23, 2026 11:37

babakks requested a review from williammartin April 23, 2026 11:37

Copilotstarted reviewing on behalf of babakks April 23, 2026 11:38 View session

CopilotAI reviewed Apr 23, 2026
View reviewed changes

babakks commented Apr 23, 2026
View reviewed changes

babakks commented May 13, 2026
View reviewed changes

williammartin approved these changes May 13, 2026
View reviewed changes

williammartin changed the title ~~chore: sign APT repositoy with both keys~~chore: sign APT repository with both keysJul 21, 2026

chore: sign APT repositories with both keys
c0f9cf8
We're going to sign our APT repository with both keys, but keep the RPM repository and artifacts signed with the currently used key. Signed-off-by: Babak K. Shandiz <babakks@github.com>

babakks force-pushed the babakks/sign-apt-repo-with-both-keys branch from d926d0c to c0f9cf8Compare August 18, 2026 14:15

babakks requested a review from BagToad August 18, 2026 14:16

BagToad approved these changes Aug 18, 2026
View reviewed changes

babakks enabled auto-merge August 18, 2026 14:24

babakks merged commit 9d1ebcc into trunkAug 18, 2026
11 checks passed

babakks deleted the babakks/sign-apt-repo-with-both-keys branch August 18, 2026 14:25

babakks mentioned this pull request Aug 19, 2026
chore: sign Linux repositories only with the new PGP key #14197
Draft
6 tasks

BrewTestBot mentioned this pull request Aug 20, 2026
gh 2.98.0 Homebrew/homebrew-core#299922
Merged

Navigation Menu

Uh oh!

chore: sign APT repository with both keys - #13271

chore: sign APT repository with both keys#13271
babakks merged 1 commit into
trunkfrom
babakks/sign-apt-repo-with-both-keys

babakks commented Apr 23, 2026

Uh oh!

CopilotAI left a comment

Uh oh!

babakksApr 23, 2026

Uh oh!

babakksApr 23, 2026

Uh oh!

babakksMay 13, 2026•
edited
Loading

Uh oh!

williammartin left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -1 +1 @@
		%_gpg_name GitHub CLI <opensource+cli@github.com>
		%_gpg_name 2C6106201985B60E6C7AC87323F3D4EA75716059

Uh oh!

Conversation

babakks commented Apr 23, 2026

Summary

Changes

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

babakksApr 23, 2026

Choose a reason for hiding this comment

Uh oh!

babakksApr 23, 2026

Choose a reason for hiding this comment

Uh oh!

babakksMay 13, 2026• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

williammartin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

babakksMay 13, 2026•
edited
Loading