docs: add sha/md5 checksums of keyring files#13150
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds published checksums for the official GitHub CLI Linux repository keyring files to make it easier for users to verify downloads.
Changes:
- Adds a collapsible section listing SHA256/SHA512/MD5 checksums for the
.gpgand.asckeyring files. - Documents both binary and ASCII-armored keyring URLs alongside their checksums.
Show a summary per file
| File | Description |
|---|---|
docs/install_linux.md |
Adds a <details> section under the Linux install “IMPORTANT” callout that lists checksums for the published keyring files. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
docs/install_linux.md:26
- Same as above: MD5 is collision-prone and shouldn’t be presented as an equally secure verification option. Consider adding a brief disclaimer near the checksums that MD5 is for legacy tooling only and recommend SHA256/SHA512 instead.
> SHA512: 2ca9487d88a508a1c87f06b46ba336b11cc5f20bd83915b4c2acde49d2cffbbce76af1641bf8494c29a765f96bc1fd694ebde2954b28b80dcc76376b6f1b766d
> MD5: 97100400ef48007b69e42be348cc6582
> ```
- Files reviewed: 1/1 changed files
- Comments generated: 2
f8f3e59 to
cc9c90c
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Adds published SHA/MD5 checksum values for the Linux repository keyring files to the Linux installation documentation to help users verify downloaded keyrings.
Changes:
- Adds a collapsible section containing SHA256/SHA512/MD5 checksums for the
.gpgand.asckeyring files. - Includes guidance discouraging MD5 usage except for legacy environments.
Show a summary per file
| File | Description |
|---|---|
| docs/install_linux.md | Documents checksum values for official keyring downloads to support user verification workflows. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comments suppressed due to low confidence (1)
docs/install_linux.md:16
- The phrasing "SHA256/512" is a bit ambiguous; it would be clearer to refer to the algorithms explicitly as "SHA256 and SHA512" (or "SHA-256/SHA-512"). Since these values are hard-coded, consider also noting that they will be updated when the hosted keyring files change so users understand a future mismatch may indicate an updated keyring rather than a bad download.
> **For security reasons, it is strongly recommended to only rely on SHA256/512 checksums. MD5 checksums below are only for legacy systems where SHA256/512 tooling is not available.**
>
- Files reviewed: 1/1 changed files
- Comments generated: 1
Signed-off-by: Babak K. Shandiz <babakks@github.com>
cc9c90c to
274a5d6
Compare
BagToad
approved these changes
Apr 13, 2026
elizandamlagokk-lab
left a comment
There was a problem hiding this comment.
47e7b7cd74f578e1e3145d48f669f22fd1330ca6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds SHA/MD5 checksums of our PGP keyring files (for Linux repositories) to help with users who need them for verification.
Verification
To verify that the checksums are correct, you can run these commands: