Update Node.js release signing keys#2126
Conversation
The `update-keys.sh` script needed updating to account for: * Node.js HEAD branch is now `main` * Comments added to each line in the key list
Regenerate `keys/nodejs.keys` by re-running `update-keys.sh`.
| #!/bin/sh -ex | ||
|
|
||
| curl -fsSLo- --compressed https://github.com/nodejs/node/raw/master/README.md | awk '/^gpg --keyserver hkps:\/\/keys\.openpgp\.org --recv-keys/ {print $NF}' > keys/node.keys | ||
| curl -fsSLo- --compressed https://github.com/nodejs/node/raw/main/README.md | awk '/--recv-keys.*#/{ gsub(/^.*--recv-keys\s+/,"");gsub(/\s+#.*$/,""); print }' > keys/node.keys |
There was a problem hiding this comment.
this has always felt brittle - thoughts on hosting some file on e.g. https://nodejs.org that has this info rather than getting it from the readme?
There was a problem hiding this comment.
The release WG maintains https://github.com/nodejs/release-keys/, for which there is https://github.com/nodejs/release-keys/blob/main/keys.list although that contains all keys (and not just the current active set).
|
Would it make sense to have a cron job that runs this script regularly so we get automated PRs? Similar to how we get node updates |
|
Can this land? |
|
Of course, sorry! |
4 participants
Description
Fixes the Node.js release signing key update script to account for upstream Node.js changes:
mainSyncs the list of Node.js release signing keys by running the updated script.
Remove @MylesBorins' key as he has stepped down from the releasers team.
Motivation and Context
I'm going through the Node.js releaser off-boarding steps for Myles and removing his key from this repository is one of the offboarding steps.
In general keeping the list of Node.js release signing keys is good practice.
Testing Details
Example Output(if appropriate)
Types of changes
Checklist