Embed only the key used to sign the release in the image

Open
#1,511 0 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
docker, dockerfile, node.js, shell
Domain
build-system, devops, infrastructure

Research direction

Start by reading update.sh and the image build logic containing the current for loop. Trace how the release key is selected, then verify that the resulting image embeds only the key used to sign that release, with the equivalent single-key behavior covered for Yarn.

Written by the indexing model from the issue text.

Description

keys

Problem

Currently we iterated and import all releaser keys as part of the image, rather than the one used to sign a particular release

Solution

As part of the update.sh, the particular release key should be determined and remove the current for loop in the images.
Same can be done for Yarn, as it only has a single key

Alternatives to Consider

Dominant language
Dockerfile
Stars
8.6k
Forks
2k
Avg merge
10h 19m
Merged PRs (30d)
16

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nodejs/docker-node

All issues in nodejs/docker-node

Similar issues

More Build System issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.