--- title: GitLab Extends GPG Key Expiration for Repository... description: GitLab has extended the expiration dates of two GPG keys used for signing repository metadata and Omnibus packages. The repository metadata signing key... canonical: https://daily.dev/posts/gitlab-extends-gpg-key-expiration-for-repository-metadata-and-omnibus-packages-jtfdrzyr9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GitLab Extends GPG Key Expiration for Repository Metadata and Omnibus Packages | daily.dev og:description: GitLab has extended the expiration dates of two GPG keys used for signing repository metadata and Omnibus packages. The repository metadata signing key... og:url: https://daily.dev/posts/gitlab-extends-gpg-key-expiration-for-repository-metadata-and-omnibus-packages-jtfdrzyr9 og:image: https://api.daily.dev/og/posts/JTFdrzyr9.png og:image:alt: GitLab Extends GPG Key Expiration for Repository Metadata and Omnibus Packages og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GitLab Extends GPG Key Expiration for Repository Metadata and Omnibus Packages **[Collections](https://daily.dev/sources/collections)** · 2 min read · 0 upvotes · 0 comments ## Summary GitLab has extended the expiration dates of two GPG keys used for signing repository metadata and Omnibus packages. The repository metadata signing key (fingerprint F640 3F65 44A3 8863 DAA0 B6E0 3F01 618A 5131 2F3F) now expires February 6, 2028, and the Omnibus package signing key expires February 16, 2028. Users who configured GitLab repositories before February 17, 2026 and perform explicit signature verification must manually fetch and update the extended public key from GPG keyservers or packages.gitlab.com. New users or those using standard apt/yum installation without explicit signature verification need no action. ## Content GitLab has announced an extension to the expiration date of its GPG key, which is crucial for signing GitLab repository metadata at packages.gitlab.com. This key, with the fingerprint F640 3F65 44A3 8863 DAA0 B6E0 3F01 618A 5131 2F3F, is now set to expire on February 6, 2028, instead of the previously scheduled February 27, 2026. The extension also applies to the key used for signing Omnibus packages, with its expiration shifted from February 14, 2026, to February 16, 2028. The decision to extend rather than rotate the key was made to minimize disruption for users. For users who configured GitLab repositories before February 17, 2026, a manual fetch and update of the extended key is required to ensure continued integrity of apt and yum repository metadata for Omnibus and GitLab Runner packages. These users, who validate package signatures explicitly, should update their local copy of the public key. Users who are new or who follow the standard installation procedures using typical OS package managers like apt or yum, without explicit signature verification, do not need to take any action. For those who require the updated public key, it can be retrieved from GPG keyservers or downloaded directly from packages.gitlab.com. GitLab support is also available via support@gitlab.com for further assistance. ## Similar posts on daily.dev - [GitHub CLI Linux package signing key expires September 5](https://daily.dev/posts/github-cli-linux-package-signing-key-expires-september-5-rhg8i7n3z) · GitHub Changelog · 0 upvotes · 0 comments - [New PGP signing key for GitHub CLI Linux packages](https://daily.dev/posts/new-pgp-signing-key-for-github-cli-linux-packages-kgsmvokij) · GitHub Changelog · 0 upvotes · 0 comments - [Package Signing Key Rotation](https://daily.dev/posts/package-signing-key-rotation-zzlqgfue3) · InfluxData · 2 upvotes · 0 comments - [Changes to packages.gitlab.com: What you need to know](https://daily.dev/posts/changes-to-packages-gitlab-com-what-you-need-to-know-bpul2dbdq) · GitLab · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#devops](https://daily.dev/tags/devops), [#gitlab](https://daily.dev/tags/gitlab) [View this post on daily.dev](https://daily.dev/posts/gitlab-extends-gpg-key-expiration-for-repository-metadata-and-omnibus-packages-jtfdrzyr9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GitLab Extends GPG Key Expiration for Repository Metadata and Omnibus Packages","url":"https://daily.dev/posts/gitlab-extends-gpg-key-expiration-for-repository-metadata-and-omnibus-packages-jtfdrzyr9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/gitlab-extends-gpg-key-expiration-for-repository-metadata-and-omnibus-packages-jtfdrzyr9"},"datePublished":"2026-02-24T14:07:05.765Z","dateModified":"2026-02-24T14:07:22.539Z","description":"GitLab has extended the expiration dates of two GPG keys used for signing repository metadata and Omnibus packages. The repository metadata signing key...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d79b06d520bfb98a64b58156bd09890c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d79b06d520bfb98a64b58156bd09890c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/gitlab-extends-gpg-key-expiration-for-repository-metadata-and-omnibus-packages-jtfdrzyr9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devops,gitlab","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"GitLab Extends GPG Key Expiration for Repository Metadata and Omnibus Packages"}]} ```