Public GPG key updated for Trivy deb/rpm repositories

[DmitriyLewen]

Public GPG key updated for Trivy deb/rpm repositories

As part of the ongoing security hardening following the security incident (conclusion), we have rotated the GPG signing key used for the Trivy deb and rpm package repositories (trivy-repo).

The old GPG key (2E2D3567461632C84BB6CD6FE9D0A3616276FA6C) has been replaced with a new key (825AD9036F7C850E6A6FED4935B8ACA44FD9CA9F). All future packages will be signed with the new key.

Error you will see with the old key

Debian/Ubuntu (apt):

W: GPG error: https://aquasecurity.github.io/trivy-repo/deb generic InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 2E2D3567461632C8
E: The repository 'https://get.trivy.dev/deb generic InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

RHEL/CentOS (yum/dnf):

Import of key(s) didn't help, wrong key(s)?
Public key for trivy_0.70.0_Linux-ARM64.rpm is not installed. Failing package is: trivy-0.70.0-1.aarch64
 GPG Keys are configured as: https://aquasecurity.github.io/trivy-repo/deb/public.key
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'yum clean packages'.
Error: GPG check FAILED

How to fix: update the GPG key

Debian/Ubuntu:

# Import the new key
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null

# Update package lists and upgrade trivy
sudo apt-get update
sudo apt-get install --only-upgrade trivy

RHEL/CentOS:

# Import the new key
sudo rpm --import https://aquasecurity.github.io/trivy-repo/rpm/public.key

# Update trivy
sudo yum update trivy

Why was the key rotated?

As described in the conclusion post, a full credential reset was performed as part of the incident remediation — all previously issued tokens and keys were revoked. The GPG signing key for the package repository was rotated as part of this effort to ensure the integrity of future releases.

[cpswan]

The error that I was seeing (that eventually brought me here) was:

E: https://aquasecurity.github.io/trivy-repo/deb generic InRelease is not (yet) available (The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 35B8ACA44FD9CA9F)

Though when I did gpg --show-keys /usr/share/keyrings/trivy.gpg it was the expected 2E2... key:

pub   rsa3072 2019-05-06 [SC] [expires: 2029-05-03]
      2E2D3567461632C84BB6CD6FE9D0A3616276FA6C
uid                      trivy

[nikpivkin]

Hi @cpswan !

2E2D3567461632C84BB6CD6FE9D0A3616276FA6C is an old fingerprint. You need to update the public key.

Here's what I see:

root@92d2f42b2b1f:/# gpg --show-keys /usr/share/keyrings/trivy.gpg
gpg: directory '/root/.gnupg' created
gpg: keybox '/root/.gnupg/pubring.kbx' created
gpg: /root/.gnupg/trustdb.gpg: trustdb created
pub   rsa4096 2026-04-16 [SC] [expires: 2029-04-15]
      825AD9036F7C850E6A6FED4935B8ACA44FD9CA9F
uid                      trivy-repo <oss@aquasec.com>

[cpswan]

Thanks @nikpivkin

I was all set when I posted the comment. Just that other people might be searching for the same signature in the error message I was seeing (that was previously coming up blank on Google).