nodesource / nodesource/distributions

Debian repository setup script stores GPG key in wrong directory and installs `apt-transport-https`

Open
#1,855 1 comment 1 reaction 1 assignee View on GitHub

@riosje is already working on this.

Since Apr 28, 2025.

Dominant language
Shell
Stars
13.8k
Forks
3.1k
PR merge metrics
No merged PRs in 30d

Description

Describe your bug
On https://deb.nodesource.com/, the user is instructed to download and execute a script for setting up the package repository together with its GPG key. The script stores the downloaded key in /usr/share/keyrings which, according to this Debian wiki page, is wrong. It states:

If future updates to the certificate will be managed by an apt/dpkg package as recommended below, then it SHOULD be downloaded into /usr/share/keyrings using the same filename that will be provided by the package. If it will be managed locally , it SHOULD be downloaded into /etc/apt/keyrings instead.

I couldn't find a package that manages the key going forward, so it should be stored in /etc/apt/keyrings. Please either fix the script to store the key in the correct location or provide a package for managing the key.

The script also installs apt-transport-https which is a dummy since at least Debian Stretch. Please stop installing that useless package.

Distribution Information:

  • OS: Debian, Ubuntu
  • Version: Any supported

Node Version:

  • Node: >=18

To Reproduce
Steps to reproduce the behavior:

  1. Follow instructions from https://deb.nodesource.com/

Expected behavior

  1. The GPG key is stored in /etc/apt/keyrings OR an additional package is installed that manages the key in /usr/share/keyrings
  2. The dummy package apt-transport-https is NOT installed

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.