What is the GPG key currently used when merging in the UI?

[CLOVIS-AI]

Select Topic Area

Question

Body

Official sources mention that the official GPG key used by GitHub is the one available at https://github.com/web-flow.gpg (5DE3E0509C47EA3CF04A42D34AEE18F83AFDEB23). However, it is expired.

pub   rsa2048 2017-08-16 [SC] [expired: 2024-01-16]
      5DE3E0509C47EA3CF04A42D34AEE18F83AFDEB23
uid           [ expired] GitHub (web-flow commit signing) <noreply@github.com>

I have seen the key 968479A1AFF927E37D1A566BB5690EEEBB952194 used in some projects, that claims to belong to GitHub:

pub   rsa4096 2024-01-16 [SC]
      968479A1AFF927E37D1A566BB5690EEEBB952194
uid           [ unknown] GitHub <noreply@github.com>

Can you clarify whether this key is indeed affiliated with GitHub, and if so, provide an authoritative download URL similar to the previous one (https://github.com/web-flow.gpg)?

[n-thumann]

web-flow.gpg actually contains both the old, expired and the new public key:

➜  ~ curl -s https://github.com/web-flow.gpg | gpg --show-keys
pub   rsa2048 2017-08-16 [SC] [expired: 2024-01-16]
      5DE3E0509C47EA3CF04A42D34AEE18F83AFDEB23
uid                      GitHub (web-flow commit signing) <noreply@github.com>

pub   rsa4096 2024-01-16 [SC]
      968479A1AFF927E37D1A566BB5690EEEBB952194
uid                      GitHub <noreply@github.com>

It's mentioned in https://github.blog/2024-01-16-rotating-credentials-for-github-com-and-new-ghes-patches/ ✌️

[CLOVIS-AI]

Oh, indeed, I didn't notice it contained two keys. That answers all my questions, thanks a lot 👍