Changes / Terraform Cloud (HCP) / Hashicorp Linux packages GPG key rotation

Terraform Cloud (HCP): Major incident: Hashicorp Linux packages GPG key rotation

Summary

HashiCorp reported a major Linux package-signing degradation: the published GPG fingerprint was outdated and could mismatch the active key, affecting package verification. The incident ran from 2026-09-10 13:24 UTC to 2026-09-10 20:40 UTC (7 h 16 min). HashiCorp updated apt/rpm repository keys and documentation, worked to re-sign older-key packages, and reported resolution.

Machine-written from the diff below (Sol; type: incident degradation). Check the diff before relying on it.

Major incidentLabel: degradation (model (Jev), 34%)Changed Detected Source: status.hashicorp.com

What changed

AddedTitle#1
Before: not present
After: Hashicorp Linux packages GPG key rotation
AddedImpact#2
Before: not present
After: major
AddedStatus#3
Before: not present
After: resolved
AddedStart time#4
Before: not present
After: 2026-09-10 13:24 UTC
AddedResolved time#5
Before: not present
After: 2026-09-10 20:40 UTC
AddedUpdateidentified#6
Before: not present
After: We are currently updating documentation and package verification guidance following an ongoing GPG key rotation for all HashiCorp Linux packages. The fingerprint currently displayed on our site is outdated and may not match the active signing key. We are actively updating the published fingerprint information and related documentation. We will provide an update once the corrected fingerprint details are available.
AddedUpdateidentified#7
Before: not present
After: We have updated the keys in the apt and rpm repos and the documentation. Our engineers are working to identify and re-sign packages signed with the older key
AddedUpdateidentified#8
Before: not present
After: Our engineers have identified the issue and are working through remaining packages.
AddedUpdatemonitoring#9
Before: not present
After: Our Engineering team has implemented a fix to resolve the issue. We are monitoring the situation closely and will post an update as soon as the issue is fully resolved.
AddedUpdateresolved#10
Before: not present
After: Our Engineering team has resolved the issue. These systems should now be operating normally. If you continue to experience any problems, please open a ticket with our support team.

First version of this incident archived by Rewindex. View the live incident.

History of this incident

When (UTC)ChangeKind
Major incident: Hashicorp Linux packages GPG key rotation (this change)
HashiCorp reported a major Linux package-signing degradation: the published GPG fingerprint was outdated and could mismatch the active key, affecting package verification. The incident ran from 2026-09-10 13:24 UTC to 2026-09-10 20:40 UTC (7 h 16 min). HashiCorp updated apt/rpm repository keys and documentation, worked to re-sign older-key packages, and reported resolution.
Major incident

All Terraform Cloud (HCP) changes → · Terraform Cloud (HCP) profile · Markdown · JSON