Repository navigation
Expired key 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 Rafael Gonzaga 2026-07-08 #57
Description
The key 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 used to sign the Node.js 26.5.1 security update from 2026-07-29 expired already on 2026-07-08
sig cert 8beab4dfcf555ef4 2024-07-08T15:48:49Z 2026-07-08T15:48:49Z
Also displayed through
https://keyserver.ubuntu.com/pks/lookup?search=890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4+&fingerprint=on&op=index
Logs
From docker-node build test for Node.js 26.5.1
#8 7.675 + curl -fsSLO --compressed https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-x64.tar.xz
#8 7.807 + curl -fsSLO --compressed https://nodejs.org/dist/v26.5.1/SHASUMS256.txt.asc
#8 7.843 + gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc
#8 7.846 gpg: Signature made Wed Jul 29 14:02:46 2026 UTC
#8 7.846 gpg: using RSA key 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4
#8 7.846 gpg: Good signature from "RafaelGSS <rafael.nunu@hotmail.com>" [expired]
#8 7.846 gpg: Note: This key has expired!
#8 7.846 Primary key fingerprint: 890C 08DB 8579 162F EE0D F9DB 8BEA B4DF CF55 5EF4
#8 7.847 + gpgconf --kill all
#8 7.855 + rm -rf /tmp/tmp.Gl5wihUNIO
#8 7.857 + grep node-v26.5.1-linux-x64.tar.xz$ SHASUMS256.txt
#8 7.857 + sha256sum -c -
#8 7.883 node-v26.5.1-linux-x64.tar.xz: OKcc: @RafaelGSS
Activity
MikeMcC399 commentedon Aug 31, 2026
Gentle reminder @RafaelGSS !
I'm still seeing your key expired on https://keyserver.ubuntu.com/pks/lookup?search=890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4+&fingerprint=on&op=index
Did you make any progress in attempting to get it renewed?
Also, I wonder if there could be a check done when releasing Node.js to make sure that a key used to sign a release is not already expired.
RafaelGSS commentedon Aug 31, 2026
Oh, I fixed it locally, but I forgot to upload it to the keyservers. #59
MikeMcC399 commentedon Aug 31, 2026
https://keyserver.ubuntu.com/pks/lookup?search=890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4+&fingerprint=on&op=index is now showing
sig cert 8beab4dfcf555ef4
2025-06-04T16:02:06Z 2027-06-04T16:02:06Z
with expiry on 2027-06-04T16:02:06Z
From my point of view, this issue is resolved. Edit: That is however because https://github.com/nodejs/docker-node/blob/main/update-keys.sh uses the keyring to extract the fingerprint only and relies on keyservers for verification. For full resolution of this issue regarding other consumers of the keyring, PR #59 would need to land.
Needed also by https://github.com/cypress-io/cypress-docker-images which relies completely on the keyring.
aduh95 commentedon Aug 31, 2026
keyring: update expiry for RafaelGSS key (nodejs#59)