Cloud-init / cloud-config to install node.js

Question

From reading the cloud-init docs (https://cloudinit.readthedocs.io/en/latest/topics/modules.html#apt-configure), it appears that this user-data should add the Nodesource source and key for apt, and install Node v18:

apt:
  sources:
    nodejs:
      source: deb https://deb.nodesource.com/node_18.x $RELEASE main
      keyserver: https://deb.nodesource.com/gpgkey/nodesource.gpg.key
packages:
  - nodejs

The URLs do appear to reference the package and a key. However, cloud-init adds a .list file in /etc/apt/sources.list.d/, doesn't add a key file in /usr/share/keyrings/, and complains that

W: GPG error: https://deb.nodesource.com/node_18.x jammy InRelease: The following signatures couldn't be verified because the public 
key is not available: NO_PUBKEY 1655A0AB68576280
E: The repository 'https://deb.nodesource.com/node_18.x jammy InRelease' is not signed.

and doesn't install Node.

When installing Node by writing an apt list file, the package reference looks like this:

deb [signed-by=/usr/share/keyrings/nodejs.gpg] https://deb.nodesource.com/node_18.x jammy main

I could put something like that on the source: line, but what key file name would I reference?

Answer 1

Turns out you need the key ID. You can extract it using

wget -qO- https://deb.nodesource.com/gpgkey/nodesource.gpg.key | gpg --with-fingerprint --with-colons | awk -F: '/^fpr/ { print $10 }'

or from the log, if you have an earlier failure to look at.

The nodesource key is in the Ubuntu keyserver, so apt don't actually need you to specify a keyserver:

# gpg --keyserver=keyserver.ubuntu.com --recv-keys 9FD3B784BC1C6FC31A8A0A1C1655A0AB68576280
gpg: key 1655A0AB68576280: public key "NodeSource <[email protected]>" imported

apt:
  sources:
    nodejs:
      source: deb [signed-by=$KEY_FILE] https://deb.nodesource.com/node_18.x $RELEASE main
#      keyserver: https://deb.nodesource.com/gpgkey/nodesource.gpg.key
      keyid: 9FD3B784BC1C6FC31A8A0A1C1655A0AB68576280
packages:

  - nodejs