# Blog: GPG Key Rotation for Falco Packages (2026)

DevFeed: [Blog: GPG Key Rotation for Falco Packages (2026)](<https://devfeed.tech/articles/blog-gpg-key-rotation-for-falco-packages-2026-32517.md>)

Original publisher: [Read original article](<https://falco.org/blog/gpg-key-rotation-2026/>)

Published: 2025-12-12T00:00:00Z

Content type: release

Language: en

Sources: [Falco - Falco](<https://devfeed.tech/sources/falco-falco.md>), [Falco - The Falco blog](<https://devfeed.tech/sources/falco-the-falco-blog.md>)

Topics: [Falco](<https://devfeed.tech/topics/falco.md>), [Security](<https://devfeed.tech/topics/security.md>), [Package manager](<https://devfeed.tech/topics/package-manager.md>), [releases](<https://devfeed.tech/topics/releases.md>), [apt](<https://devfeed.tech/topics/apt.md>)

Tags: [announcements](<https://devfeed.tech/tags/announcements.md>), [apt](<https://devfeed.tech/tags/apt.md>), [falco](<https://devfeed.tech/tags/falco.md>), [import](<https://devfeed.tech/tags/import.md>), [installation](<https://devfeed.tech/tags/installation.md>), [releases](<https://devfeed.tech/tags/releases.md>), [rotation](<https://devfeed.tech/tags/rotation.md>), [rsa](<https://devfeed.tech/tags/rsa.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

Falco maintainers are rotating the 4096-bit RSA GPG key used to sign official RPM and DEB packages because the existing key expires on January 17, 2026. The transition uses a soft launch followed by a hard cut-over, and existing users should update their keyrings before January 12, 2026.

## Source excerpt

The GPG key used to sign official Falco packages (RPM and DEB) is set to expire on January 17, 2026. To ensure the security and continuity of our software distribution, the Falco maintainers will be rotating to a new 4096-bit RSA key. We have designed a two-phase "Soft Launch" strategy to make this transition as smooth as possible, providing a one-month transition window before the old key is retired. The Rotation Plan To avoid immediate disruption, we are rolling out the new key in two distinct phases. You can follow the detailed progress in our tracking issue #3750. Phase 1: Soft Launch (Dec 12, 2025) What happens: The new GPG key has been published and added to our repository configuration. Dev Builds: Will begin using the New Key immediately. Stable Builds: No stable releases are planned for this phase. If any hotfixes are released, they will be signed with New Key as well. Key Bundle: The official key URL has been updated to serve a bundle containing both the Old (valid) and New (valid) keys. Phase 2: Hard Cut-Over (Jan 12-17, 2026) What happens: This is the maintenance window where we fully switch to the new key. Mass Resign: All existing stable packages on download.falco.org will be resigned with the New Key. Revocation: The Old Key will be officially revoked and removed from the active bundle. Impact: If you have not updated your keyring by this date, your package manager (apt or yum) will reject updates with a signature verification error. Action Items for Users We strongly recommend all users update their GPG keyring before January 12, 2026 to avoid interruption. New Users If you are installing Falco for the first time following our Install on a host (DEB,RPM) instructions, no action is required. The installation process will guide you to fetch the new key bundle, ensuring you are ready for both phases. Existing Users If you have an existing Falco installation, you must manually import the new key. We have updated the key file at our standard URL to includ