Skip to content

Commit 0222008

Browse files
aduh95aduh95
committed
chore: switch to official release-keys repo to verify Node.js
1 parent e519cfc commit 0222008

File tree

6 files changed

+29
-63
lines changed

6 files changed

+29
-63
lines changed

‎Dockerfile-alpine.template‎

Lines changed: 9 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -31,36 +31,28 @@ RUN addgroup -g 1000 node \
3131
binutils-gold \
3232
g++ \
3333
gcc \
34-
gnupg \
34+
gpgv \
3535
libgcc \
3636
linux-headers \
3737
make \
3838
python3 \
3939
py-setuptools \
40-
# use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150
41-
&& export GNUPGHOME="$(mktemp -d)" \
42-
# gpg keys listed at https://github.com/nodejs/node#release-keys
43-
&& for key in \
44-
"${NODE_KEYS[@]}"
45-
; do \
46-
{ gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
47-
{ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
48-
done \
40+
&& export PUBRING="$(mktemp)" \
41+
&& curl -fsSLo "$PUBRING" --compressed https://github.com/nodejs/release-keys/raw/HEAD/gpg-only-active-keys/pubring.kbx \
4942
&& curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \
50-
&& curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \
51-
&& gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \
52-
&& gpgconf --kill all \
53-
&& rm -rf "$GNUPGHOME" \
54-
&& grep " node-v$NODE_VERSION.tar.xz\$" SHASUMS256.txt | sha256sum -c - \
55-
&& tar -xf "node-v$NODE_VERSION.tar.xz" \
43+
&& curl -fsSL --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \
44+
| gpgv --keyring="$PUBRING" --output - \
45+
| grep " node-v$NODE_VERSION.tar.xz\$"
46+
| sha256sum -c - \
47+
&& tar -xJf "node-v$NODE_VERSION.tar.xz" \
5648
&& cd "node-v$NODE_VERSION" \
5749
&& ./configure \
5850
&& make -j$(getconf _NPROCESSORS_ONLN) V= \
5951
&& make install \
6052
&& apk del .build-deps-full \
6153
&& cd .. \
6254
&& rm -Rf "node-v$NODE_VERSION" \
63-
&& rm "node-v$NODE_VERSION.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt; \
55+
&& rm "$PUBRING" "node-v$NODE_VERSION.tar.xz"; \
6456
fi \
6557
&& rm -f "node-v$NODE_VERSION-linux-$ARCH-musl.tar.xz" \
6658
# Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451

‎Dockerfile-debian.template‎

Lines changed: 9 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -15,24 +15,16 @@ RUN ARCH= && dpkgArch="$(dpkg --print-architecture)" \
1515
i386) ARCH='x86';; \
1616
*) echo "unsupported architecture"; exit 1 ;; \
1717
esac \
18-
# use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150
19-
&& export GNUPGHOME="$(mktemp -d)" \
20-
# gpg keys listed at https://github.com/nodejs/node#release-keys
21-
&& set -ex \
22-
&& for key in \
23-
"${NODE_KEYS[@]}"
24-
; do \
25-
{ gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
26-
{ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
27-
done \
28-
&& curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH.tar.xz" \
29-
&& curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \
30-
&& gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \
31-
&& gpgconf --kill all \
32-
&& rm -rf "$GNUPGHOME" \
33-
&& grep " node-v$NODE_VERSION-linux-$ARCH.tar.xz\$" SHASUMS256.txt | sha256sum -c - \
18+
&& export PUBRING="$(mktemp)" \
19+
&& set -exo pipefail \
20+
&& curl -fsSLo "$PUBRING" --compressed https://github.com/nodejs/release-keys/raw/HEAD/gpg-only-active-keys/pubring.kbx \
21+
&& curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \
22+
&& curl -fsSL --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \
23+
| gpgv --keyring="$PUBRING" --output - \
24+
| grep " node-v$NODE_VERSION.tar.xz\$"
25+
| sha256sum -c - \
3426
&& tar -xJf "node-v$NODE_VERSION-linux-$ARCH.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \
35-
&& rm "node-v$NODE_VERSION-linux-$ARCH.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \
27+
&& rm "node-v$NODE_VERSION-linux-$ARCH.tar.xz" "$PUBRING" \
3628
&& ln -s /usr/local/bin/node /usr/local/bin/nodejs \
3729
# smoke tests
3830
&& node --version \

‎Dockerfile-slim.template‎

Lines changed: 10 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -17,25 +17,18 @@ RUN ARCH= OPENSSL_ARCH= && dpkgArch="$(dpkg --print-architecture)" \
1717
esac \
1818
&& set -ex \
1919
# libatomic1 for arm
20-
&& apt-get update && apt-get install -y ca-certificates curl wget gnupg dirmngr xz-utils libatomic1 --no-install-recommends \
20+
&& apt-get update && apt-get install -y ca-certificates curl wget gpgv dirmngr xz-utils libatomic1 --no-install-recommends \
2121
&& rm -rf /var/lib/apt/lists/* \
22-
# use pre-existing gpg directory, see https://github.com/nodejs/docker-node/pull/1895#issuecomment-1550389150
23-
&& export GNUPGHOME="$(mktemp -d)" \
24-
# gpg keys listed at https://github.com/nodejs/node#release-keys
25-
&& for key in \
26-
"${NODE_KEYS[@]}"
27-
; do \
28-
{ gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys "$key" && gpg --batch --fingerprint "$key"; } || \
29-
{ gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key"; } ; \
30-
done \
31-
&& curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-$ARCH.tar.xz" \
32-
&& curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \
33-
&& gpg --batch --decrypt --output SHASUMS256.txt SHASUMS256.txt.asc \
34-
&& gpgconf --kill all \
35-
&& rm -rf "$GNUPGHOME" \
36-
&& grep " node-v$NODE_VERSION-linux-$ARCH.tar.xz\$" SHASUMS256.txt | sha256sum -c - \
22+
&& export PUBRING="$(mktemp)" \
23+
&& set -exo pipefail \
24+
&& curl -fsSLo "$PUBRING" --compressed https://github.com/nodejs/release-keys/raw/HEAD/gpg-only-active-keys/pubring.kbx \
25+
&& curl -fsSLO --compressed "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION.tar.xz" \
26+
&& curl -fsSL --compressed "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \
27+
| gpgv --keyring="$PUBRING" --output - \
28+
| grep " node-v$NODE_VERSION.tar.xz\$"
29+
| sha256sum -c - \
3730
&& tar -xJf "node-v$NODE_VERSION-linux-$ARCH.tar.xz" -C /usr/local --strip-components=1 --no-same-owner \
38-
&& rm "node-v$NODE_VERSION-linux-$ARCH.tar.xz" SHASUMS256.txt.asc SHASUMS256.txt \
31+
&& rm "node-v$NODE_VERSION-linux-$ARCH.tar.xz" "$PUBRING" \
3932
# Remove unused OpenSSL headers to save ~34MB. See this NodeJS issue: https://github.com/nodejs/node/issues/46451
4033
&& find /usr/local/include/node/openssl/archs -mindepth 1 -maxdepth 1 ! -name "$OPENSSL_ARCH" -exec rm -rf {} \; \
4134
&& apt-mark auto '.*' > /dev/null \

‎keys/node.keys‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎update-keys.sh‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎update.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ function update_node_version() {
139139
'
140140

141141
# Add GPG keys
142-
for key_type in "node" "yarn"; do
142+
for key_type in "yarn"; do
143143
while read -r line; do
144144
pattern='"\$\{'$(echo "${key_type}" | tr '[:lower:]' '[:upper:]')'_KEYS\[@\]\}"'
145145
sed -Ei -e "s/([ \\t]*)(${pattern})/\\1${line}${new_line}\\1\\2/" "${dockerfile}-tmp"

0 commit comments

Comments
 (0)