Repository navigation
Please note in release notes when release signing keys change (pgp/gpg re v1.139.0) #8045
Description
The Linux release artifacts for Release 1.139.0 were signed with a new OpenPGP key. There was no indication given in the release notes of anything happening.
The good news is that the signing key in the docs had been updated and it's signed by the Primary key, acting as a trusted introducer and trust is maintained. That was excellent and far better operational practice than I normally see (if stuck using PGP, as we are here). Many kudos for that.
If you could just note in the release notes that there's been a change and point to where to go to find the key, that would just make life easier for users to verify. The switch to a new key without notice (that I saw) is indistinguishable from an attack.
Links to help others:
- Release signing key is the second key on https://docs.aws.amazon.com/serverless-application-model/latest/developerguide/reference-sam-cli-install-verify.html and is signed by the first key on that page, as before
- Feature request: sign release artifacts #3751 covers the introduction of the signing and is how I found the right link to get the keys
(Keyword search grep-bait: OpenPGP gnupg gpg pgp release signing)
Thank you!
Activity
vicheey commentedon Sep 13, 2025
Thanks for sharing this information to help our community who may encounter similar issues. Let me take a look at the documentation.
dcabib commentedon Oct 4, 2025
@philpennock This is an excellent suggestion and you're absolutely right that a signing key change without notice in the release notes is indistinguishable from a potential security issue. Really appreciate you calling this out and providing the detailed context with links.
We should definitely add a note in release notes whenever signing keys change. This is a security-critical piece of information that users who verify signatures (and everyone should!) need to know about. The fact that you followed proper operational practice with the key hierarchy and signing is great, but it doesn't help users if they don't know to look for it or where to find the updated key.
A simple addition to the release notes template could work here - something like a "Security" or "Release Verification" section that gets populated when keys change, pointing to the verification docs. This would be a one-time manual step during releases where keys rotate, which shouldn't happen frequently. Would you envision this as a dedicated section in the release notes, or would a prominent callout at the top of the notes work better for visibility?
Also curious - did you have any issues actually verifying the signature once you found the right key, or was it just the discovery process that was problematic?
reedham-aws commentedon Oct 20, 2025
Hello @philpennock, I have updated that specific release to mention the changes, as well as taken note in our internal documentation that all future key rotations should be documented in the release notes. Thank you for catching this!
I will be closing this issue, but if you have further questions feel free to reopen.
github-actions commentedon Oct 20, 2025
Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.