Terraform Linux repositories GPG key mismatch I was trying to install Terraform on Ubuntu with the official instructions [0]. When trying to verify Hashicorp's GPG signing key I see this command
should have the expected output of
as of the posting of this question. This also matches Hashicorp's Security page [1] under the heading Linux Package Checksum Verification.However, I see a new key created 2023-01-10 instead:
Am I correct in not trusting this key, as until Hashicorp fixes their documentation, this could be a compromised key? I assume it's related to their response to the CircleCI incident [2] but considering that their response links to their security page...don't they need to update their documentation to reflect the rotated key?[0]: https://developer.hashicorp.com/terraform/tutorials/docker-get-started/install-cli [1]: https://www.hashicorp.com/security [2]: https://discuss.hashicorp.com/t/hcsec-2023-01-hashicorp-response-to-circleci-security-alert/48842/2 |
No comments yet