NodeSource: Update GPG to prevent "Policy will reject signature within a year, see --audit for details"

[MickLesk]

This script runs on a Proxmox host and iterates over all running LXC containers.
For each container, it checks whether a NodeSource node_2x.x APT repository is configured and whether apt update --audit reports a GPG policy warning.
If the warning is detected, the script refreshes the NodeSource GPG key inside the container and reruns apt update to clear the issue.

Fixes:
Warning: https://deb.nodesource.com/node_24.x/dists/nodistro/InRelease: Policy will reject signature within a year, see --audit for details

Links:
nodesource/distributions#1865
#7332

nano /opt/fix_nodejs_gpg.sh

Enter following:

 #!/usr/bin/env bash

for CTID in $(pct list | awk '$2=="running"{print $1}'); do
  echo "==> CT $CTID: checking NodeSource repo"

  if pct exec "$CTID" -- grep -Rqs "deb.nodesource.com/node_2" \
    /etc/apt/sources.list /etc/apt/sources.list.d; then

    echo "    NodeSource repo detected"

    if pct exec "$CTID" -- bash -c '
      apt update --audit 2>&1 | grep -Eq \
      "Policy will reject signature|Policy rejected|SHA1 is not considered secure|sqv returned an error"
    '; then

      echo "    Policy issue detected – refreshing GPG key"

      pct exec "$CTID" -- bash -c '
        set -e
        mkdir -p /etc/apt/keyrings
        rm -f /etc/apt/keyrings/nodesource.gpg
        curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
          | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
        chmod 644 /etc/apt/keyrings/nodesource.gpg
        apt update &>/dev/null
      '

      echo "    GPG key refreshed"
    else
      echo "    No policy issue"
    fi
  else
    echo "    No NodeSource repo"
  fi
done

chmod +x /opt/fix_nodejs_gpg.sh

bash /opt/fix_nodejs_gpg.sh && rm -f /opt/fix_nodejs_gpg.sh

Example Output:

==> CT 400: checking NodeSource repo
    NodeSource repo detected
    Policy warning detected – refreshing GPG key
    GPG key refreshed
==> CT 401: checking NodeSource repo
    No NodeSource repo
==> CT 501: checking NodeSource repo
    No NodeSource repo
==> CT 502: checking NodeSource repo
    No NodeSource repo
==> CT 503: checking NodeSource repo
    NodeSource repo detected
    Policy warning detected – refreshing GPG key
    GPG key refreshed
==> CT 504: checking NodeSource repo
    NodeSource repo detected
    Policy warning detected – refreshing GPG key
    GPG key refreshed
==> CT 600: checking NodeSource repo
    No NodeSource repo
==> CT 999: checking NodeSource repo
    NodeSource repo detected
    Policy warning detected – refreshing GPG key
    GPG key refreshed

[MickLesk]

Update 03.02.2026:

Updated Script: The script was updated to also detect the new hard-fail APT policy errors (e.g. SHA1 rejection / sqv errors), as the previous grep only matched the pre-deadline warning and no longer triggered.

[DeNohvo]

What can we run within the LXC? I have a single LXC that needs this update so would rather avoid running anything on the host.

[MickLesk]

Really......?

mkdir -p /etc/apt/keyrings
rm -f /etc/apt/keyrings/nodesource.gpg
curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
          | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg
chmod 644 /etc/apt/keyrings/nodesource.gpg
apt update &>/dev/null

[DeNohvo]

Figured that was it, but wanted to be sure.