nodesource / nodesource/distributions
Debian repository setup script stores GPG key in wrong directory and installs `apt-transport-https`
@riosje is already working on this.
Since Apr 28, 2025.
- Dominant language
- Shell
- Stars
- 13.8k
- Forks
- 3.1k
- PR merge metrics
- No merged PRs in 30d
Description
Describe your bug
On https://deb.nodesource.com/, the user is instructed to download and execute a script for setting up the package repository together with its GPG key. The script stores the downloaded key in /usr/share/keyrings which, according to this Debian wiki page, is wrong. It states:
If future updates to the certificate will be managed by an apt/dpkg package as recommended below, then it SHOULD be downloaded into /usr/share/keyrings using the same filename that will be provided by the package. If it will be managed locally , it SHOULD be downloaded into /etc/apt/keyrings instead.
I couldn't find a package that manages the key going forward, so it should be stored in /etc/apt/keyrings. Please either fix the script to store the key in the correct location or provide a package for managing the key.
The script also installs apt-transport-https which is a dummy since at least Debian Stretch. Please stop installing that useless package.
Distribution Information:
- OS: Debian, Ubuntu
- Version: Any supported
Node Version:
- Node: >=18
To Reproduce
Steps to reproduce the behavior:
- Follow instructions from https://deb.nodesource.com/
Expected behavior
- The GPG key is stored in
/etc/apt/keyringsOR an additional package is installed that manages the key in/usr/share/keyrings - The dummy package
apt-transport-httpsis NOT installed
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.