Hashicorp vault signature validation is failing as the key is revoked

[pdpjw]

Vault image signature validation is failing. Gpg key has been revoked recently.

gpg -k 91A6E7F85D05C65630BEF18951852D87348FFC4C
pub   rsa2048 2014-02-26 [SC] [revoked: 2021-04-21]
      91A6E7F85D05C65630BEF18951852D87348FFC4C
uid           [ revoked] HashiCorp Security <[email protected]>

[mdeggies]

Hey there, are you having issues with the vault docker image? If so, please post your reproduction steps so we can take a look.

As noted in the security bulletin, we recently rotated our GPG key. We updated references to the old GPG key ID in this repo so that future builds will check against the new key ID, but local docker builds and pulls from dockerhub should continue to work without any changes. As you can see in the dockerfile, when a new build is triggered, the relevant binary is pulled down from releases.hashicorp.com. All of our binaries on releases.hashicorp.com have been validated and re-signed with the new GPG key, and these are the binaries used on fresh docker pulls.

Let us know if you have any questions about this.