chore: use release-keys keyring for gpg fingerprints#2459
chore: use release-keys keyring for gpg fingerprints#2459nschonni wants to merge 1 commit intonodejs:mainfrom
Conversation
|
@aduh95 this doesn't replace your PR, but was what I was trying to explain in the thread. If your approach doesn't get accepted by the Docker Hub people, this at least streamlines the Releaser onboarding and revoking of old keys process. |
MikeMcC399
left a comment
MikeMcC399
left a comment
There was a problem hiding this comment.
LGTM!
When ./update.sh is run, a keyring is pulled from https://github.com/nodejs/release-keys/raw/refs/heads/main/gpg-only-active-keys/pubring.kbx as advised by node > Release Keys.
There is no change to the way that keys are stored in the Dockerfile instances or to how the verification of the downloaded Node.js tarball is carried out.
https://github.com/docker-library/official-images#security describes the security requirements for official images and those requirements would continue to be satisfied.
The previous manually run update-keys.sh, which scraped the node > README.md looking for lines with --recv-keys, is replaced.
I did a spot check, removing keys from one of the Dockerfile instances before running ./update.sh. The keys were correctly and identically restored.
2 participants
Description
This doesn't change to go away from the keyservers like in #2415, but points to the upstream source, and removes the need for PRs here when onboarding new Releasers.
Motivation and Context
Testing Details
Example Output(if appropriate)
Types of changes
Checklist