Expired key signed Node.js 26.5.1 release

[MikeMcC399]

As noted in nodejs/release-keys#57

The key 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 used to sign the Node.js 26.5.1 security update from 2026-07-29 expired already on 2026-07-08.

The test logs in this repo https://github.com/nodejs/docker-node/actions/runs/30521044009 show:

gpg: Good signature from "RafaelGSS rafael.nunu@hotmail.com" [expired]

although that did not cause any fatal error. It was just logged as a warning.

#8 4.160 + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4
#8 4.989 gpg: key 8BEAB4DFCF555EF4: public key "RafaelGSS <rafael.nunu@hotmail.com>" imported
#8 4.990 gpg: Total number processed: 1
#8 4.990 gpg:               imported: 1
#8 4.991 + gpg --batch --fingerprint 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4
#8 4.993 pub   rsa3072 2022-05-17 [SC] [expired: 2026-07-08]
#8 4.993       890C 08DB 8579 162F EE0D  F9DB 8BEA B4DF CF55 5EF4
#8 4.993 uid           [ expired] RafaelGSS <rafael.nunu@hotmail.com>

#8 7.675 + curl -fsSLO --compressed https://nodejs.org/dist/v26.5.1/node-v26.5.1-linux-x64.tar.xz
#8 7.807 + curl -fsSLO --compressed https://nodejs.org/dist/v26.5.1/SHASUMS256.txt.asc
#8 7.843 + gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc
#8 7.846 gpg: Signature made Wed Jul 29 14:02:46 2026 UTC
#8 7.846 gpg:                using RSA key 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4
#8 7.846 gpg: Good signature from "RafaelGSS <rafael.nunu@hotmail.com>" [expired]
#8 7.846 gpg: Note: This key has expired!
#8 7.846 Primary key fingerprint: 890C 08DB 8579 162F EE0D  F9DB 8BEA B4DF CF55 5EF4

The keys are located in keys/node.keys.

It looks like Rafael is currently on vacation and I would assume that he will be able to renew when he returns.

We should monitor to make sure that the key list has all non-expired keys for future releases.