Companies / HashiCorp / incidents
HashiCorp: Hashicorp Linux packages GPG key rotation
HashiCorp reported a major Linux package verification issue during GPG key rotation: the published fingerprint was outdated and might not match the active signing key. The incident ran from 2026-09-10 13:24 UTC to 2026-09-10 20:40 UTC (7 h 16 min). HashiCorp updated apt/rpm repository keys and documentation, worked on re-signing older-key packages, and reported resolution.
Machine-written from the archived incident (Sol). Check the timeline before relying on it.
Affected components: RPM RepositoryLinux Package Archive SiteAPT Repository
Timeline of updates
- identified
We are currently updating documentation and package verification guidance following an ongoing GPG key rotation for all HashiCorp Linux packages. The fingerprint currently displayed on our site is outdated and may not match the active signing key. We are actively updating the published fingerprint information and related documentation. We will provide an update once the corrected fingerprint details are available.
- identified
We have updated the keys in the apt and rpm repos and the documentation. Our engineers are working to identify and re-sign packages signed with the older key
- identified
Our engineers have identified the issue and are working through remaining packages.
- monitoring
Our Engineering team has implemented a fix to resolve the issue. We are monitoring the situation closely and will post an update as soon as the issue is fully resolved.
- resolved
Our Engineering team has resolved the issue. These systems should now be operating normally. If you continue to experience any problems, please open a ticket with our support team.
Rewindex changes for this incident
- Major incident: Hashicorp Linux packages GPG key rotation 2026-09-10 13:24 UTC
Impact, status and times are the vendor’s own, as last archived. View on status.hashicorp.com (opens in new tab). HashiCorp profile · Recent HashiCorp incidents · Markdown · JSON