Terraform runs failing due to expired HashiCorp signing key

If self hosted customer are still affected, please reach out to our support team.

We are continuing to monitor for any further issues.

We identified that Terraform runs were failing when downloading the Terraform binary. The public GPG key we use to verify HashiCorp's checksum signatures had expired, causing every binary download to fail signature verification.
Runs using OpenTofu or a Custom workflow were not affected.

A fix updating the embedded HashiCorp public key has been rolled out during the week-end across our managed infrastructure.
If you are using private worker pools, you will need to cycle your worker pool so the workers pick up the latest launcher version that includes the fix. Until workers are cycled, new Terraform runs on those pools will continue to fail.
Cycling worker pool is not required if using kubernetes native workers. This is only to make sure EC2 docker based workers are refreshed.

Action required for Self-Hosted: Hotfix v5.1.1 has been published and can be used to resolve the issue on Self-Hosted installations on v5.1.0. If you are on an older Self-Hosted version, please contact your Spacelift account team — we are publishing targeted hotfixes on request.

If you cannot upgrade right now, you can unblock Terraform runs by:
- Switch from Terraform to OpenTofu if you can.
- Switch to a custom workflow for your stack and provide Terraform binary yourself
- Setting "skipVendorBinaryDownload: true" on the affected stacks, and running those stacks in a runner image that already has the terraform binary installed at the expected path.