GitLab has announced an extension to the expiration date of its GPG key, which is crucial for signing GitLab repository metadata at <a href="http://packages.gitlab.com" target="_blank" rel="noopener nofollow">packages.gitlab.com</a>. This key, with the fingerprint F640 3F65 44A3 8863 DAA0 B6E0 3F01 618A 5131 2F3F, is now set to expire on February 6, 2028, instead of the previously scheduled February 27, 2026.
The extension also applies to the key used for signing Omnibus packages, with its expiration shifted from February 14, 2026, to February 16, 2028. The decision to extend rather than rotate the key was made to minimize disruption for users.
For users who configured GitLab repositories before February 17, 2026, a manual fetch and update of the extended key is required to ensure continued integrity of apt and yum repository metadata for Omnibus and GitLab Runner packages. These users, who validate package signatures explicitly, should update their local copy of the public key.
Users who are new or who follow the standard installation procedures using typical OS package managers like apt or yum, without explicit signature verification, do not need to take any action.
For those who require the updated public key, it can be retrieved from GPG keyservers or downloaded directly from <a href="http://packages.gitlab.com" target="_blank" rel="noopener nofollow">packages.gitlab.com</a>. GitLab support is also available via <a href="https://support@gitlab.com" target="_blank" rel="noopener nofollow">support@gitlab.com</a> for further assistance.

Collections

GitLab has extended the expiration dates of two GPG keys used for signing repository metadata and Omnibus packages. The repository metadata signing key (fingerprint F640 3F65 44A3 8863 DAA0 B6E0 3F01 618A 5131 2F3F) now expires February 6, 2028, and the Omnibus package signing key expires February 16, 2028. Users who configured GitLab repositories before February 17, 2026 and perform explicit signature verification must manually fetch and update the extended public key from GPG keyservers or packages.gitlab.com. New users or those using standard apt/yum installation without explicit signature verification need no action.

GitLab Extends GPG Key Expiration for Repository Metadata and Omnibus Packages