Repository navigation
Expired key signed Node.js 26.5.1 release #2591
Description
As noted in nodejs/release-keys#57
The key
890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4used to sign the Node.js 26.5.1 security update from 2026-07-29 expired already on 2026-07-08.
The test logs in this repo https://github.com/nodejs/docker-node/actions/runs/30521044009 show:
gpg: Good signature from "RafaelGSS rafael.nunu@hotmail.com" [expired]
although that did not cause any fatal error. It was just logged as a warning.
#8 4.160 + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4
#8 4.989 gpg: key 8BEAB4DFCF555EF4: public key "RafaelGSS <rafael.nunu@hotmail.com>" imported
#8 4.990 gpg: Total number processed: 1
#8 4.990 gpg: imported: 1
#8 4.991 + gpg --batch --fingerprint 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4
#8 4.993 pub rsa3072 2022-05-17 [SC] [expired: 2026-07-08]
#8 4.993 890C 08DB 8579 162F EE0D F9DB 8BEA B4DF CF55 5EF4
#8 4.993 uid [ expired] RafaelGSS <rafael.nunu@hotmail.com>#8 7.675 + curl -fsSLO --compressed https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-x64.tar.xz
#8 7.807 + curl -fsSLO --compressed https://nodejs.org/dist/v26.5.1/SHASUMS256.txt.asc
#8 7.843 + gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc
#8 7.846 gpg: Signature made Wed Jul 29 14:02:46 2026 UTC
#8 7.846 gpg: using RSA key 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4
#8 7.846 gpg: Good signature from "RafaelGSS <rafael.nunu@hotmail.com>" [expired]
#8 7.846 gpg: Note: This key has expired!
#8 7.846 Primary key fingerprint: 890C 08DB 8579 162F EE0D F9DB 8BEA B4DF CF55 5EF4The keys are located in keys/node.keys.
It looks like Rafael is currently on vacation and I would assume that he will be able to renew when he returns.
We should monitor to make sure that the key list has all non-expired keys for future releases.
Activity
MikeMcC399 commentedon Aug 10, 2026
MikeMcC399 commentedon Aug 12, 2026
@RafaelGSS
Could you please let us know when your key has been renewed?
https://keyserver.ubuntu.com/ still shows
MikeMcC399 commentedon Aug 16, 2026
Closing, as this issue cannot be fixed in the
docker-noderepo.