Realign Node.js signing keys #1382
Description
Situation
Node.js signing keys are hard-coded in
cypress-docker-images/factory/installScripts/node/default.sh
Lines 25 to 37 in f768990
The official public list of these keys is in the Node.js README > Release keys document section, including both "Primary GPG keys" and "Other keys used to sign some previous releases"
Assessment
| Key | Section | Releaser |
|---|---|---|
| 4ED778F539E3634C779C87C6D7062848A1AB005C | previous | Beth Griggs |
| 141F07595B7B3FFE74309A937405533BE57C7D57 | previous | Bryan English |
| 74F12602B6F1C4E913FAA37AD3A89613643B6201 | previous | Danielle Adams |
| DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 | primary | Juan José Arboleda |
| 61FC681DFB92A079F1685E77973F295594EC4689 | previous | Juan José Arboleda |
| CC68F5A3106FF448322E48ED27F5E38D5B0A215F | primary | Marco Ippolito |
| 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 | primary | Michaël Zasso |
| C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8 | previous | Myles Borins |
| 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 | primary | Rafael Gonzaga |
| C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C | primary | Richard Lau |
| 108F52B48DB57BB0CC439B2997B01419BD92F80A | primary | Ruy Adorno |
| A363A499291CBBC940DD62E41F10027AF002F8B0 | primary | Ulises Gascón |
| C0D6248439F1D5604AAFFB4021D900FFDB233756 | primary | Antoine du Hamel |
All keys from the Primary GPG section are included in the list. Only a few of the keys from the previous release list are included.
The keys are mainly sorted by full name.
Suggestion
For better future maintenance, re-order the list to use the same order of keys used in the Node.js README > Release keys document section, which is to separate primary and previous key lists and to order them by name.
Delay this change until the next key change from the Node.js organization. This should be soon, as the following key is planned for demotion
C0D6248439F1D5604AAFFB4021D900FFDB233756 Antoine du Hamel
with replacement being
5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 Antoine du Hamel
(As a policy, don't add more keys from the "Other keys used to sign some previous releases" section, unless they are actually needed. This will be the case for C0D6248439F1D5604AAFFB4021D900FFDB233756 which will be needed after it is demoted, as it was used to sign Node.js 22.17.0 for example.)