Repository navigation
GPG public key used to sign release artifacts #747
Description
Activity
I'll review this next week to consider publishing this within the documentation now published directly from the repository.
Updated to OP description for context clarity:
"Since transfer of ownership from Hashicorp -> Broadcom and the release of v2.1.0+, the GPG key used to sign artifacts has changed."
Whilst we wait to publish this in the documentation, users can obtain the public key used to sign releases v2.1.0 and later (post-transfer from HashiCorp to Broadcom) at
https://keys.openpgp.orgundeross-packer-plugins.pdl@broadcom.com.Ryan Johnson, Broadcom
Reacted by Samuel FORESTIERThis functionality has been released in v2.3.0 of the plugin.
For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!
I'm going to lock this issue because it has been closed for 30 days. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.
- locked as resolved and limited conversation to collaborators
on Sep 3, 2026
Code of Conduct
Detail
Dear maintainers,
Since transfer of ownership from Hashicorp -> Broadcom and the release of v2.1.0+, the GPG key used to sign artifacts has changed. We couldn't find a way to retrieve the new one across project documentation.
Would it be possible to publish somewhere the public key (or at least its fingerprint) to allow proper* assets signature verification ?
Thanks for your time and your work,
Bye 👋
Suggestion
No response