@codebytere can you allow contributors to add commits to this PR< I will update the images before merging.

@LaurentGoderre Allow edits from maintainers was already ticked; are you unable to push commits?

I didn't try. I also didn't see anything in the UI indicating it was enabled so KI wrongly assumed it wasn't.... :S

ah gotcha, np 😁

let me know if there are any issues!

@codebytere @LaurentGoderre

could you please nicely explain, why this official image need be inserted some personal PGP keys?

Will this be security issue for us as customers, who pull the images and used in our produciton environment?

@ozbillwang we need those keys to validate that the node package we include in the image has not been tampered with (the releases are signed by various members of the Node project).

@tianon do you think it would be worthwhile to add a step to remove the keys we add?

Most of our images use a temporary GNUPGHOME and delete once verified, like redis. It would make sense to not pollute the root user's gpg home with keys, since users of the image might expect it to be empty.