Skip to main content

Package Signing Keys

Every package and all repository metadata served from extras.getpagespeed.com is GPG-signed. This page is the official list of the GetPageSpeed signing keys and their full fingerprints. Verify any key you received, from the release package, a keyserver, or a mirror, against the fingerprints below.

RPM keys

Which key signs depends on your distribution, not on the file type: on a given system the same key signs both the packages and the repository metadata. Both RPM keys are installed into /etc/pki/rpm-gpg/ by the getpagespeed-extras-release package.

RPM signing key (2017)

  • File: RPM-GPG-KEY-GETPAGESPEED (RSA-2048, 2017)
  • UID: GetPageSpeed Builder <info@getpagespeed.com>
  • Signs: the packages and the repository metadata (repomd.xml) for Enterprise Linux 7 and 8 (CentOS, RHEL, Rocky, AlmaLinux, Oracle Linux), Fedora, Amazon Linux 2 and 2023, and SLES, in every channel, and the getpagespeed-extras-release package itself
  • Independent copy: keys.openpgp.org
D1A3 7295 C6B0 5ED8 43DB  D501 0CD6 0276 222B 0E83

RPM signing key (2023)

  • File: RPM-GPG-KEY-GETPAGESPEED-2023 (RSA-4096, 2023)
  • UID: GetPageSpeed LLC <builder@getpagespeed.com>
  • Signs: the packages and the repository metadata (repomd.xml) for Enterprise Linux 9 and 10 (RHEL, Rocky, AlmaLinux, Oracle Linux), in every channel
  • Independent copy: keys.openpgp.org
3D88 6B41 39AD 1046 3DC1  B085 82CC 0F5C C786 7353

APT key

APT archive signing key

  • File: deb-archive-keyring.gpg (RSA-4096, 2025), installed at /etc/apt/keyrings/deb-archive-keyring.gpg
  • UID: GetPageSpeed LLC <builder@getpagespeed.com>
  • Signs: the InRelease index of every Debian and Ubuntu suite; signatures are made by its signing subkey ending DE5A 73CC 4D52 6369
  • Independent copy: keys.openpgp.org
3285 2239 743A F54F 4D88  251B 57B5 CB35 8BAA 3ED4

Verifying a key

Print the fingerprint of a key file and compare it to this page:

gpg --show-keys --with-fingerprint RPM-GPG-KEY-GETPAGESPEED

On RPM systems, list the imported GetPageSpeed keys and check a downloaded package:

rpm -q gpg-pubkey --queryformat '%{NAME}-%{VERSION} %{SUMMARY}\n' | grep -i getpagespeed
rpm --checksig package.rpm

On Debian and Ubuntu, APT verifies every index automatically through the Signed-By keyring above; no manual step is needed.

Key changes, if ever needed, ship through an update of the getpagespeed-extras-release package and are announced in advance. If a key you received does not match this page, do not install, and contact us.