rewindex

CompaniesCodecovIncidents

Codecov: Codecov uploaders (Action/Orb/Step) fail gpg verification

No impact listedStatus: resolvedStarted Resolved (0 min)1 updatestspg.io (opens in new tab)

Timeline of updates

  1. resolved

    On Saturday, June 6th, the Codecov gpg public key located at keybase.io/codecovsecurity was absent. This caused widespread outages for users uploading with the Codecov
    - GitHub Action
    - CircleCI Orb
    - Bitrise Step

    In order to quickly move and prevent further outages, the Codecov team deleted the codecovsecurity account and created codecovsecops with the same public gpg key. This key can be verified against any pre-existing CLI to prove it is the same key and also at about.codecov.io/security. The key location was updated in all of the above uploaders on the latest versions.

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves this record existed by then and has not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Impact, status and times are the vendor’s own, as last archived. View on stspg.io (opens in new tab).

Cite this

Status incident (vendor impact label: none) posted by Codecov, started 2026-06-06 13:00 UTC, resolved after 0 min, 1 update(s).

Title
Codecov uploaders (Action/Orb/Step) fail gpg verification
Vendor
Codecov
Date
URL
https://rewindex.com/company/codecov/incidents/3tyvhnpyxnk8

Codecov profileRecent Codecov incidentsAll outages on June 6, 2026Codecov in June 2026MarkdownJSON