Problem
Currently, all the Node.js releaser keys are read/validated during the image build, so things like #2591 can crop up. Releasers that may not be involved in the active releases are also included in the list of fingerprints.
Solution
In the update.sh (or replacement), read from the individual release's SHASUM.txt and find the single fingerprint that was used to sign the release, and just include that one fingerprint in the Dockerfile. That fingerprint should still be validated that it is in the node.keys prior to inclusion.
Alternatives to Consider
Using/changing to a single key might cause more "git noise" than the current diffs, but is similar to the CHECKSUM noise we have with the Alpine images.
Problem
Currently, all the Node.js releaser keys are read/validated during the image build, so things like #2591 can crop up. Releasers that may not be involved in the active releases are also included in the list of fingerprints.
Solution
In the update.sh (or replacement), read from the individual release's SHASUM.txt and find the single fingerprint that was used to sign the release, and just include that one fingerprint in the Dockerfile. That fingerprint should still be validated that it is in the
node.keysprior to inclusion.Alternatives to Consider
Using/changing to a single key might cause more "git noise" than the current diffs, but is similar to the CHECKSUM noise we have with the Alpine images.