Skip to content

chore: switch to official release-keys repo #216

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
rvagg merged 3 commits into from
Feb 23, 2026
Merged

chore: switch to official release-keys repo #216

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9945fbc
chore: switch to official `release-keys` repo
aduh95 Feb 20, 2026
8b963ff
fixup! chore: switch to official `release-keys` repo
aduh95 Feb 20, 2026
ac1cc1f
fixup! chore: switch to official `release-keys` repo
aduh95 Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 1 addition & 9 deletions fetch-source/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,20 +6,12 @@ ARG UID=1000
RUN addgroup -g $GID node \
&& adduser -u $UID -G node -s /bin/sh -D node

RUN apk add --no-cache bash gnupg curl
RUN apk add --no-cache bash gpgv curl

COPY --chown=node:node run.sh /home/node/run.sh

VOLUME /out/

USER node

RUN mkdir ~/.gnupg && \
chmod 700 ~/.gnupg && \
for key in $(curl -sL https://raw.githubusercontent.com/nodejs/docker-node/HEAD/keys/node.keys) \
; do \
gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \
done

ENTRYPOINT [ "/home/node/run.sh" ]
20 changes: 7 additions & 13 deletions fetch-source/run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,7 @@ curl_with_retry()
done
}

set -x
set -e
set -exo pipefail

release_urlbase="$1"
disttype="$2"
Expand All @@ -29,21 +28,16 @@ config_flags=

cd /home/node

gpg_keys=$(curl -sL https://raw.githubusercontent.com/nodejs/docker-node/HEAD/keys/node.keys)

for key in ${gpg_keys}; do
gpg --list-keys "$key" ||
gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \
done

# Curl with retry
curl_with_retry "$source_url"

if [[ "$disttype" = "release" ]]; then
curl_with_retry https://github.com/nodejs/release-keys/raw/HEAD/gpg-only-active-keys/pubring.kbx
curl_with_retry "${source_urlbase}/SHASUMS256.txt.asc"
gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc
grep " node-${fullversion}.tar.xz\$" SHASUMS256.txt | sha256sum -c -

gpgv --keyring="pubring.kbx" --output - < SHASUMS256.txt.asc \
| grep " node-${fullversion}.tar.xz\$" \
| sha256sum -c -
fi

mv -f node-${fullversion}.tar.xz /out/
mv -f node-${fullversion}.tar.xz /out/
8 changes: 1 addition & 7 deletions recipes/headers/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,13 +6,7 @@ ARG UID=1000
RUN addgroup -g $GID node \
&& adduser -u $UID -G node -s /bin/sh -D node

RUN apk add --no-cache bash gnupg curl

RUN for key in $(curl -sL https://raw.githubusercontent.com/nodejs/docker-node/HEAD/keys/node.keys) \
; do \
gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \
done
RUN apk add --no-cache bash gpgv curl

COPY --chown=node:node run.sh /home/node/run.sh

Expand Down
22 changes: 9 additions & 13 deletions recipes/headers/run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
#!/usr/bin/env bash
set -x
set -e

set -exo pipefail

release_urlbase="$1"
disttype="$2"
Expand All @@ -14,21 +14,17 @@ config_flags=

cd /home/node

gpg_keys=$(curl -sL https://raw.githubusercontent.com/nodejs/docker-node/HEAD/keys/node.keys)

for key in ${gpg_keys}; do
gpg --list-keys "$key" ||
gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" || \
gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" ; \
done

curl -fsSLO --compressed "${source_urlbase}/node-${fullversion}-headers.tar.gz"
curl -fsSLO --compressed "${source_urlbase}/node-${fullversion}-headers.tar.xz"

if [[ "$disttype" = "release" ]]; then
curl -fsSLO --compressed "${source_urlbase}/SHASUMS256.txt.asc"
gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc
grep " node-${fullversion}-headers.tar.*\$" SHASUMS256.txt | sha256sum -c -
pubring=$(mktemp)
curl -sSLo "$pubring" https://github.com/nodejs/release-keys/raw/HEAD/gpg-only-active-keys/pubring.kbx

curl -sSL "${source_urlbase}/SHASUMS256.txt.asc" \
| gpgv --keyring="${pubring}" --output - \
| grep " node-${fullversion}-headers.tar.*\$" SHASUMS256.txt \
| sha256sum -c -
fi

mv node-${fullversion}-headers.tar* /out/