Clarification of Keycloak 26.8.0 server archive signing authority #53717

kenclark03-wq · 2026-10-07T21:45:47Z

kenclark03-wq
Oct 7, 2026

We are conducting a documentation-only provenance review of Keycloak 26.8.0 for a possible isolated nonproduction laboratory.
The official release lists keycloak-26.8.0.tar.gz.asc and keycloak-26.8.0.zip.asc. However, the Keycloak Signing Keys page describes its published signing scope as Maven artifacts and the Terraform provider.
Could the project clarify:

Whether these detached signatures authenticate the corresponding 26.8.0 server archives.
The complete authorized signing-key fingerprint and any relevant signing-subkey relationship.
The authoritative public source establishing that key’s authority for server archive releases.
Applicable key validity, revocation or rotation information.
Whether the signing-key page’s scope statement is outdated.
A release-specific, publisher-controlled documentation reference would be particularly helpful.
No software has been acquired or executed as part of this review.

aashish254 · 2026-10-08T05:05:32Z

aashish254
Oct 8, 2026

yes — the .asc files are gpg signatures for the archives, verifying them is exactly the point. gpg --verify keycloak-26.8.0.tar.gz.asc keycloak-26.8.0.tar.gz tells you if the artifact is intact and signed.

the authorized signer keys are published by the keycloak team — check their release documentation for the current key list. only signatures from those keys count; a valid signature from an unknown key proves nothing.

one gotcha: fetch the keys from keycloak's own pages, not a random keyserver hit with a matching name. keyserver identities are self-asserted.

0 replies

JuanTorchia · 2026-11-03T17:59:59Z

JuanTorchia
Nov 3, 2026

Not a maintainer, but I checked this against the 26.8.0 release assets, Maven Central and the website source.

1. Do the .asc files authenticate the server archives? Yes. They're detached signatures, and both verify with the published key (output abridged):

$ curl -sLO https://www.keycloak.org/keys/keycloak-2.asc && gpg --import keycloak-2.asc
$ gpg --verify keycloak-26.8.0.tar.gz.asc keycloak-26.8.0.tar.gz
gpg: Signature made Thu Oct  1 05:38:24 2026 UTC
gpg:                using EDDSA key 861AB50E8CC6611FB6BC01A6B8F12EA26FD6EEBA
gpg: Good signature from "Keycloak Bot <keycloak.bot@gmail.com>" [unknown]

keycloak-26.8.0.zip.asc verifies the same way, with the same key. gpg will also warn that the key is "not certified with a trusted signature"; that's normal until you trust it locally after checking the fingerprint.

2. Fingerprint and subkeys. The signature is made directly by the primary key, not a subkey:

pub ed25519 2024-02-13 [SC]: 861A B50E 8CC6 611F B6BC 01A6 B8F1 2EA2 6FD6 EEBA
sub cv25519 2024-02-13 [E]: 0957 C97B 32C1 255C 3DE8 B342 B231 B90E 822B 71DC (encryption only)

3. Authoritative source. The Signing Keys page lists this key for "Maven artifacts after January 2024", and the downloads page links to it from the server section. The GitHub release archives are Maven artifacts: keycloak-26.8.0.tar.gz and .zip are byte-identical to org.keycloak:keycloak-quarkus-dist:26.8.0 on Maven Central, and so are their .asc files. So they fall within that key's documented scope. I couldn't find a release-specific publisher statement that names the server archives explicitly; the Signing Keys page plus that Maven Central identity is the closest reference, and the gap is really item 5.

4. Validity / revocation. The key expires 2027-02-12; signatures made before that stay verifiable afterwards, gpg will just note the key has expired. The page doesn't describe rotation or revocation. No revocation is published: the copy on keyserver.ubuntu.com matches the website one, and keys.openpgp.org doesn't carry it. Either way, the fingerprint on keycloak.org/keys is the reference, not a keyserver copy.

5. Is the scope statement outdated? I'd say yes. It still says only Maven artifacts and the Terraform provider are signed and that website downloads may be signed "in the future", while the release archives carry valid signatures. The downloads page also links the .sha1 files but not the .asc ones. The page source is pages/keys.ftl in keycloak-web, so a small PR there would be the easy fix. Broader signing work (images, Helm) is tracked in #54273.

0 replies

Navigation Menu

Repository navigation

Clarification of Keycloak 26.8.0 server archive signing authority #53717

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Clarification of Keycloak 26.8.0 server archive signing authority #53717

Uh oh!

kenclark03-wq Oct 7, 2026

Replies: 2 comments

Uh oh!

aashish254 Oct 8, 2026

Uh oh!

JuanTorchia Nov 3, 2026

kenclark03-wq
Oct 7, 2026

aashish254
Oct 8, 2026

JuanTorchia
Nov 3, 2026