Eclipse Platform PGP signing key expiry on 15 December 2026

[doravecz]

Hello,

On an Eclipse-based product I noticed that the Eclipse Platform PGP signing subkey with fingerprint
9E3044071B758EBCB7E45673700E4F39BC05364B
currently expires on 15 December 2026.

I can see that current Eclipse Platform builds are still being signed with this key.
I'm not knowledgeable about the key extension/renewal process so I'd like to ask the following:

• Will the validity of the existing key/subkey be extended while keeping the same fingerprint?
• Or is Eclipse planning to introduce a new signing key/subkey with a different fingerprint?
• If a new fingerprint will be used, will there be a transition mechanism intended to allow older Eclipse/p2-based applications that pre-trust the current key to consume future Eclipse repositories without an application update?

I'm trying to determine whether existing Eclipse-based installations need to ship updated trusted-key material before December 2026.

Thank you in advance!

[merks]

It's a really good question! The Eclipse Foundation maintains the keys provided to our org.eclipse.ci instances. I assume they update things when required, but it's always good to validate assumptions!

@fredg02

Could you shed light on the process by which keys are updated before their expiry date?

---

The Oomph project (which provides also the Eclipse Installer) generally collects and maintains a set of trusted keys from their uses in various p2 update sites that it knows about:

https://github.com/eclipse-oomph/oomph/blob/master/setups/keys/trusted-keys.asc

That's why you'll see so many keys in the Eclipse IDEs (which all have Oomph installed):

But you'll see some of them are contributed by extension points in the plugin.xml, i.e.,

https://github.com/eclipse-platform/eclipse.platform/blob/fd0d61c472c1cc06846553c931008287c40b8722/platform/org.eclipse.platform/plugin.xml#L109-L112

So it may well be (it seems likely) that we need to update those files:

https://github.com/eclipse-platform/eclipse.platform/tree/master/platform/org.eclipse.platform/keys

Even the key store shows this to be quite old:

https://keyserver.ubuntu.com/pks/lookup?search=9e3044071b758ebcb7e45673700e4f39bc05364b&fingerprint=on&op=index

The Oomph product catalog generator uses the above keystore server to collect up-to-date information about the key chain of each key that it seems being used in the p2 repositories it scans...

[merks]

BTW, its perfectly valid for something to be signed with an expired key as long as it was signed during the validity period of the key, i.e., not before and not after... So it is relatively likely that such things will be present. I'm not sure if the key is kind of renewed such that the fingerprints remain the same or if we will get new ones entirely.

[fredg02]

• Will the validity of the existing key/subkey be extended while keeping the same fingerprint?

Yes.

• Or is Eclipse planning to introduce a new signing key/subkey with a different fingerprint?

No.

Could you shed light on the process by which keys are updated before their expiry date?

The expiry date will be updated, and the modified public key will be uploaded to a public keyserver.

[merks]

That sounds quite simple and painless then! Thanks for the quick answer!! 🚀

Oomph always gets the key data details from the server so that will update automatically, but the platform's *.asc files will likely be an older snapshot at some point relatively soon...