GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — chore: pull Releaser keys from keyring instead of README by nschonni · Pull Request #2607 · nodejs/docker-node

Conversation

@nschonni

@nschonni nschonni commented Aug 14, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Description

Doesn't replace the way the keys are embedded in the Dockerfiles, but use the newer keyring file to read the fingerprints.

Motivation and Context

Testing Details

Example Output(if appropriate)

Types of changes

  • Documentation
  • Version change (Update, remove or add more Node.js versions)
  • Variant change (Update, remove or add more variants, or versions of variants)
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Other (none of the above)

Checklist

  • My code follows the code style of this project.
  • My change requires a change to the documentation.
  • I have updated the documentation accordingly.
  • I have read the CONTRIBUTING.md document.
  • All new and existing tests passed.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@nschonni
chore: pull Releaser keys from keyring instead of README
75000f3
@nschonni nschonni mentioned this pull request Aug 14, 2026
chore: use release-keys keyring for gpg fingerprints #2459
Closed
1 of 12 tasks
@aduh95

aduh95 commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

I don't really see the point, this does not change the fact that building our docker images depend on the external key servers.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@MikeMcC399

This comment was marked as resolved.

Sign in to view
@nschonni

nschonni commented Aug 14, 2026

Copy link
Copy Markdown
Member Author

@aduh95 my thinking is, that pulling from the keyring rather than scrapping the Markdown is a better approach. It also moves from a repo that can be changed by any collaborator to one owned by the releasers.
My future thought is that once this script depends on keyring, a CI job on the release-keys repo could trigger the scipt.
As I type out this response though, I'm now thinking that the better approach might be just to pull the recent automation over to the release-keys repo entirely, and just leave the keys/node.keys file here

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@aduh95

aduh95 commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

I'm -1 on touching the node.keys if we can avoid it, as I said in #2459 (comment), it's relied upon by other repos. Also there's value is having it in this repo, if we have to pull the list from somewhere else, it would be hard not to get to a situation where generating the Dockerfiles is no longer reproducible.

There might have been some miscommunication at some point, because tbh none of this effort removes any pain points (at least that I'm aware of), so hum, if ain't broke, don't fix it?
The pain point we have is that the Dockerfiles themselves depend on external key servers we do not control, which means building the docker images is not reproducible as soon as those servers make a change. Last time, it was because I uploaded a new key which overwrote my previous key, which broke the docker images for all versions I had previously signed. A solution for that is #2415, and I'd be relieved if that effort could gain some traction, or at least focus on finding a solution, as it's a bit frustrating that we accept that far-from-ideal current situation.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@nschonni

nschonni commented Aug 23, 2026

Copy link
Copy Markdown
Member Author

@aduh95 this doesn't change/remove the node.keys like the other PR does, just uses the keyring as the source of truth

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

MikeMcC399
MikeMcC399 approved these changes Aug 31, 2026
View reviewed changes

@MikeMcC399 MikeMcC399 left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to move forward with this enhancement PR.

Executing the existing script ./update-keys.sh in the main branch produces no change.

It needs the changes in this PR, which pull from https://github.com/nodejs/release-keys/blob/main/gpg-only-active-keys/pubring.kbx, to get up-to-date results.

Branch Result
main no change
nschonni:kbk-script removes 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600

The key 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 belongs to @targos who has stepped down from the Releasers role. This key removal was implemented in nodejs/release-keys#58 for the keyring, however no change was made in the list on https://github.com/nodejs/node#release-keys.

docker-node should stop including the 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 key when any Dockerfile is updated for a new release. This is however only possible if the synchronization is up-to-date.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@MikeMcC399 MikeMcC399 added the keys Related to keys used to sign releases label Aug 31, 2026
@nschonni
nschonni merged commit 64b464f into nodejs:main Aug 31, 2026
4 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@nschonni
nschonni deleted the kbk-script branch August 31, 2026 13:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MikeMcC399 MikeMcC399 MikeMcC399 approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

keys Related to keys used to sign releases

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@nschonni @aduh95 @MikeMcC399
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.