fix(build): NodeSource repo via pkg-cache-repos.sh (pinned key, cache-aware) #7

2026-10-22T14:14:40Z

jknapp commented

2026-10-22 14:14:40 +00:00

scripts/install-node.sh: replaces wget -qO- https://rpm.nodesource.com/setup_N.x | bash - (unverified remote script) with /usr/local/sbin/pkg-cache-repos.sh nodesource N, which writes the same nodesource-nodejs repo (origin URL, gpgcheck=1, module_hotfixes=1, priority=9) using the signing key committed in keys/pkg-cache/RPM-GPG-KEY-nodesource (242B 8138 31AF 0956 2B6C 46F7 6B88 DA4E 3AF2 8A14). The unused N|Solid repo is no longer added.
Dockerfile: the Node RUN is wrapped in pkg-cache-repos.sh rpm ... restore so with PKG_CACHE NodeSource + AlmaLinux/EPEL come through https://192.168.1.40/{nodesource,almalinux,epel}/ (origin as 2nd baseurl); the shipped repo file keeps the origin URL.
scripts/pkg-cache-repos.sh + keys/pkg-cache/ synced byte-identical from cloud-apache-container (canonical, branch ci/pkg-cache-more-upstreams).

Tested

Local, upstream fallback (no PKG_CACHE), BASE_IMAGE digest-pinned: NODEVER=26 -> node 26.12.1 / npm 12.2.1; NODEVER=18 -> node 18.20.8 / bundled npm 10.8.2 (EOL warning). Shipped repo file = origin URL + file:// key; no /var/lib/pkg-cache-repos.
Cache path (throwaway runner-template CT on pve vmbr2): NODEVER=24 with PKG_CACHE=https://192.168.1.40 -> baseurl=https://192.168.1.40/nodesource/pub_24.x/... https://rpm.nodesource.com/..., node 24.22.1, restore: no reference to 192.168.1.40 left.

🤖 Generated with Claude Code

- `scripts/install-node.sh`: replaces `wget -qO- https://rpm.nodesource.com/setup_N.x | bash -` (unverified remote script) with `/usr/local/sbin/pkg-cache-repos.sh nodesource N`, which writes the same `nodesource-nodejs` repo (origin URL, `gpgcheck=1`, `module_hotfixes=1`, `priority=9`) using the signing key committed in `keys/pkg-cache/RPM-GPG-KEY-nodesource` (242B 8138 31AF 0956 2B6C 46F7 6B88 DA4E 3AF2 8A14). The unused N|Solid repo is no longer added. - Dockerfile: the Node RUN is wrapped in `pkg-cache-repos.sh rpm` ... `restore` so with `PKG_CACHE` NodeSource + AlmaLinux/EPEL come through `https://192.168.1.40/{nodesource,almalinux,epel}/` (origin as 2nd baseurl); the shipped repo file keeps the origin URL. - `scripts/pkg-cache-repos.sh` + `keys/pkg-cache/` synced byte-identical from cloud-apache-container (canonical, branch `ci/pkg-cache-more-upstreams`). **Tested** - Local, upstream fallback (no PKG_CACHE), BASE_IMAGE digest-pinned: NODEVER=26 -> node 26.12.1 / npm 12.2.1; NODEVER=18 -> node 18.20.8 / bundled npm 10.8.2 (EOL warning). Shipped repo file = origin URL + file:// key; no /var/lib/pkg-cache-repos. - Cache path (throwaway runner-template CT on pve vmbr2): NODEVER=24 with PKG_CACHE=https://192.168.1.40 -> `baseurl=https://192.168.1.40/nodesource/pub_24.x/... https://rpm.nodesource.com/...`, node 24.22.1, restore: no reference to 192.168.1.40 left. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jknapp added 1 commit 2026-10-22 14:14:40 +00:00

fix(build): NodeSource repo via pkg-cache-repos.sh (pinned key, cache-aware) 14957dbbe1

install-node.sh no longer runs `curl https://rpm.nodesource.com/setup_N.x | bash`
(an unverified remote script). `pkg-cache-repos.sh nodesource N` writes the same
nodesource-nodejs repo (origin URL in the shipped image, gpgcheck=1) with the
signing key committed in keys/pkg-cache/RPM-GPG-KEY-nodesource. With PKG_CACHE
the repo goes through the internal cache (https://192.168.1.40/nodesource/,
origin as 2nd baseurl) and the RUN restores the origin files at the end.
The unused N|Solid repo (18/20/22) is no longer added.

pkg-cache-repos.sh + keys/pkg-cache synced byte-identical from
cloud-apache-container branch ci/pkg-cache-more-upstreams (canonical).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

jknapp merged commit 5e80046e82 into main

2026-10-22 14:27:11 +00:00

jknapp deleted branch ci/pkg-cache-nodesource

2026-10-22 14:27:12 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cloud-hosting-platform/cloud-node-container#7