install-node.sh no longer runs `curl https://rpm.nodesource.com/setup_N.x | bash`
(an unverified remote script). `pkg-cache-repos.sh nodesource N` writes the same
nodesource-nodejs repo (origin URL in the shipped image, gpgcheck=1) with the
signing key committed in keys/pkg-cache/RPM-GPG-KEY-nodesource. With PKG_CACHE
the repo goes through the internal cache (https://192.168.1.40/nodesource/,
origin as 2nd baseurl) and the RUN restores the origin files at the end.
The unused N|Solid repo (18/20/22) is no longer added.
pkg-cache-repos.sh + keys/pkg-cache synced byte-identical from
cloud-apache-container branch ci/pkg-cache-more-upstreams (canonical).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- The first Node 24/26 run timed out on every job: public AlmaLinux mirrors
served the runners at 1-150 kB/s. Use the CT130 package cache the same way
cloud-apache-container does (same pkg-cache-repos.sh and pinned CA), with
the upstream repos as fallback when the probe fails. epel-release is now
GPG-verified before install instead of fetched unverified by URL.
- npm 12 requires Node >=22.22.2; on 18/20 keep the npm Node ships with.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
shadowdaoandClaude Opus 5.5