NPO-Accounting/houdini - Software Freedom Conservancy Forgejo

NPO-Accounting/houdini

2 lines

90 B

Text

Raw Normal View History

docker: Node/Yarn: install nodesource & yarn keys from local copy As an additional security measure, don't use the network version of setup_14.x. Instead, save nodesource and yarn keys locally and do the operations in the Dockerfile to install the keys. Then, simply do the apt install of the dependencies needed from both places. Keep a copy of the setup_14.x in the data directory as well. In future, it might be useful to have a script that compares the versions of that script and keys on the nodesource and yarn websites — mainly to semi-automatically verify if upstream details have changed.

2021-08-09 22:47:20 +00:00

deb [signed-by=/usr/share/keyrings/yarnpkg.gpg] https://dl.yarnpkg.com/debian stable main