GitLab extends Omnibus package signing key expiration to 2028

GitLab uses a GNU Privacy Guard (GPG) key to sign all Omnibus packages created within the CI pipelines to ensure that the packages have not been tampered with. This key is separate from the repository metadata signing key used by package managers and the GPG signing key for the GitLab Runner. The Omnibus package signing key, which was set to expire on Feb. 14, 2026, has been extended to expire on Feb, 16, 2028.Why are we extending the deadline?The package signing key's expiration is extended periodically to comply with GitLab security policies and to limit the exposure should the key become compromised. The key's expiration is extended instead of rotating to a new key to be less disruptive for users, as rotating would require all users to replace their trusted keyWhat do I need to do?The only action that needs to be taken is to update your copy of the package signing key if you validate the signatures on the Omnibus packages that GitLab distributes.The package signing key is not the key that signs the repository metadata used by the OS package managers like apt or yum. Unless you are specifically verifying the package signatures or have configured your package manager to verify the package signatures, there is no action needed on your part to continue installing Omnibus packages.More information concerning verification of the package signatures is available in the Omnibus documentation. If you just need to refresh a copy of the public key, then you can find it on any of the GPG keyservers by searching for support@gitlab.com or using the key ID of 98BF DB87 FCF1 0076 416C 1E0B AD99 7ACC 82DD 593D.Alternatively, you could download it directly from packages.gitlab.com using the URL: https://packages.gitlab.com/gitlab/gitlab-ce/gpgkey/gitlab-gitlab-ce-CB947AD886C8E8FD.pub.gpg.What if I need additional help?Please open an issue in the omnibus-gitlab issue tracker.

Source: https://about.gitlab.com/blog/gitlab-extends-omnibus-package-signing-key-expiration-to-2028/