Summary
The Linux install path intermittently fails when fetching the APT signing key. https://packages.twingate.com/apt/gpg.key returns HTTP 401 Unauthorized, which breaks the install step and fails the whole job. It is intermittent — the same workflow succeeds on a re-run with no changes.
What happens
The "Install Twingate (Linux)" step runs:
curl -fsSL https://packages.twingate.com/apt/gpg.key | gpg --batch --yes --no-tty --dearmor -o /usr/share/keyrings/twingate-client-keyring.gpg
When the key endpoint returns 401, curl -f exits non-zero and emits no body, so gpg receives empty input and fails. The step then exits with code 2.
A public APT signing key returning 401 looks like a server-side/CDN issue — the request carries no credentials and none should be required.
Error output (verbatim)
curl: (22) The requested URL returned error: 401
gpg: no valid OpenPGP data found.
##[error]Process completed with exit code 2.
Environment
- Action:
twingate/github-action@v1, "Install Twingate (Linux)" step
- Runner: GitHub-hosted
ubuntu-latest
- Frequency: intermittent — succeeds on re-run with no changes
- Example occurrence (UTC): 2026-07-24T15:35:05Z
Impact
Non-deterministic CI deploy failures; each occurrence requires a manual job re-run.
Request
Please investigate why https://packages.twingate.com/apt/gpg.key intermittently returns 401, and confirm whether that endpoint should ever require authorization. If transient upstream failures are expected, it would help if the install step retried the key fetch (and surfaced the HTTP status) rather than silently piping an empty 401 body into gpg.
Summary
The Linux install path intermittently fails when fetching the APT signing key.
https://packages.twingate.com/apt/gpg.keyreturns HTTP 401 Unauthorized, which breaks the install step and fails the whole job. It is intermittent — the same workflow succeeds on a re-run with no changes.What happens
The "Install Twingate (Linux)" step runs:
curl -fsSL https://packages.twingate.com/apt/gpg.key | gpg --batch --yes --no-tty --dearmor -o /usr/share/keyrings/twingate-client-keyring.gpgWhen the key endpoint returns 401,
curl -fexits non-zero and emits no body, sogpgreceives empty input and fails. The step then exits with code 2.A public APT signing key returning 401 looks like a server-side/CDN issue — the request carries no credentials and none should be required.
Error output (verbatim)
Environment
twingate/github-action@v1, "Install Twingate (Linux)" stepubuntu-latestImpact
Non-deterministic CI deploy failures; each occurrence requires a manual job re-run.
Request
Please investigate why
https://packages.twingate.com/apt/gpg.keyintermittently returns 401, and confirm whether that endpoint should ever require authorization. If transient upstream failures are expected, it would help if the install step retried the key fetch (and surfaced the HTTP status) rather than silently piping an empty 401 body intogpg.