Companies / Terraform Cloud (HCP) / incidents

Terraform Cloud (HCP): Hashicorp Linux packages GPG key rotation

Impact: majorStatus: resolvedStarted 2026-09-10 13:24 UTCResolved 2026-09-10 20:40 UTC (7.3 h)5 updatesSource: status.hashicorp.com

Summary

HashiCorp reported a major Linux package-signing degradation: the published GPG fingerprint was outdated and could mismatch the active key, affecting package verification. The incident ran from 2026-09-10 13:24 UTC to 2026-09-10 20:40 UTC (7 h 16 min). HashiCorp updated apt/rpm repository keys and documentation, worked to re-sign older-key packages, and reported resolution.

Machine-written from the archived incident (Sol). Check the timeline before relying on it.

Affected components: RPM RepositoryLinux Package Archive SiteAPT Repository

Timeline of updates

identified2026-09-10 13:24 UTC
We are currently updating documentation and package verification guidance following an ongoing GPG key rotation for all HashiCorp Linux packages. The fingerprint currently displayed on our site is outdated and may not match the active signing key. We are actively updating the published fingerprint information and related documentation. We will provide an update once the corrected fingerprint details are available.
identified2026-09-10 14:45 UTC
We have updated the keys in the apt and rpm repos and the documentation. Our engineers are working to identify and re-sign packages signed with the older key
identified2026-09-10 15:50 UTC
Our engineers have identified the issue and are working through remaining packages.
monitoring2026-09-10 16:35 UTC
Our Engineering team has implemented a fix to resolve the issue. We are monitoring the situation closely and will post an update as soon as the issue is fully resolved.
resolved2026-09-10 20:40 UTC
Our Engineering team has resolved the issue. These systems should now be operating normally. If you continue to experience any problems, please open a ticket with our support team.

Rewindex changes for this incident

Major incident: Hashicorp Linux packages GPG key rotation 2026-09-10 13:24 UTC

Impact, status and times are the vendor’s own, as last archived. View on status.hashicorp.com (opens in new tab). Terraform Cloud (HCP) profile · Recent Terraform Cloud (HCP) incidents · Markdown · JSON