[BUG] Intermittent GPG signature failures on windows-latest runners

[dionhaefner]

Describe the bug

     _____          _
    / ____|        | |
   | |     ___   __| | ___  ___ _____   __
   | |    / _ \ / _` |/ _ \/ __/ _ \ \ / /
   | |___| (_) | (_| |  __/ (_| (_) \ V /
    \_____\___/ \__,_|\___|\___\___/ \_/
                            Wrapper-0.2.7
                           
==> Detected windows
 -> Downloading https://cli.codecov.io/latest/windows/codecov.exe
  % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
                                 Dload  Upload  Total   Spent   Left   Speed

  0      0   0      0   0      0      0      0                              0
100 10.48M 100 10.48M   0      0 78.21M      0                              0
100 10.48M 100 10.48M   0      0 78.11M      0                              0
100 10.48M 100 10.48M   0      0 78.05M      0                              0
==> Finishing downloading windows:latest
      Version: v11.2.8
 
gpg: directory '/c/Users/runneradmin/.gnupg' created
gpg: /c/Users/runneradmin/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
gpg: Total number processed: 1
gpg:               imported: 1
==> Verifying GPG signature integrity
 -> Downloading https://cli.codecov.io/latest/windows/codecov.exe.SHA256SUM
 -> Downloading https://cli.codecov.io/latest/windows/codecov.exe.SHA256SUM.sig
 
gpg: Signature made Tue Apr 21 19:20:02 2026 CUT
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: Good signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 2703 4E7F DB85 0E0B BC2C  62FF 806B B28A ED77 9869
codecov.exe: FAILED
sha256sum: WARNING: 1 computed checksum did NOT match
==> Could not verify SHASUM. Please contact Codecov if problem continues
    Exiting...

To Reproduce

Not sure, we're not really doing anything out of the ordinary. This is just plain uses: codecov/codecov-action@v6.0.0 on windows-latest.

Full link to logs: https://github.com/pasteurlabs/tesseract-core/actions/runs/24805534706/job/72598654138

[linear]

CCMRG-2176

[vm-001]

https://github.com/webhookx-io/webhookx/actions/runs/24824688840/job/72658211047?pr=327 same issue

[big-andy-coates]

Seeing the same: https://github.com/creek-service/creek-kafka/actions/runs/24825290995/job/72660946586?pr=871

[Flamefire]

It doesn't just affect Windows:
https://github.com/boostorg/boost-ci/actions/runs/24829811586/job/72675135041?pr=327

gpg: directory '/home/runner/.gnupg' created
gpg: keybox '/home/runner/.gnupg/pubring.kbx' created
gpg: /home/runner/.gnupg/trustdb.gpg: trustdb created
gpg: key 806BB28AED779869: public key "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" imported
gpg: Total number processed: 1
gpg:               imported: 1
==> Verifying GPG signature integrity
 -> Downloading https://cli.codecov.io/latest/linux/codecov.SHA256SUM
 -> Downloading https://cli.codecov.io/latest/linux/codecov.SHA256SUM.sig
 
gpg: Signature made Tue Apr 21 19:28:03 2026 UTC
gpg:                using RSA key 27034E7FDB850E0BBC2C62FF806BB28AED779869
gpg: BAD signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]

[Felixoid]

Same issue in mozilla/sccache https://github.com/mozilla/sccache/actions/runs/24830556685/job/72677671038?pr=2644

[Teebor-Choka]

Affects also linux.
https://github.com/hoprnet/hoprnet/actions/runs/24829036890/job/72673307247?pr=8067

[amotl]

It doesn't just affect Windows.
Affects also linux.

Right, it is all across the board. We can confirm the intermittency though. The easiest explanation is that some HTTP CDN cache purge is missing, so certain CDN edge nodes are still delivering outdated signatures that don't match the delivered binaries, or the other way round. Alternatively, something more serious is happening?

Edit: Ah, we can see it's possibly a version bump race condition, and @CrepuscularIRIS already submitted a fix per GH-1941. Thanks! 🙇

[amotl]

Let me demonstrate the flaky / intermittent failure behaviour on behalf of an average CI run #24837655518 where 1/3 of all test matrix slots go south because of signature validation problems when uploading coverage reports to Codecov. @thomasrockhu / @thomasrockhu-codecov to the rescue, or @ibrahim0814?

gpg: BAD signature from "Codecov Uploader (Codecov Uploader Verification Key) <security@codecov.io>" [unknown]
==> Could not verify signature. Please contact Codecov if problem continues

[Alami-Amine]

This also shows up in Linux