fix: explicit check for Node.js key import (#1380)

Author: MikeMcC399

factory/.env

@@ -18,7 +18,7 @@ NODE_VERSION="${FACTORY_DEFAULT_NODE_VERSION}"
 
 # Update the FACTORY_VERSION to deploy cypress/factory if you make changes to
 # BASE_IMAGE, FACTORY_DEFAULT_NODE_VERSION, YARN_VERSION, factory.Dockerfile or installScripts
-FACTORY_VERSION='5.11.2'
+FACTORY_VERSION='5.11.3'
 
 # Chrome versions: https://www.ubuntuupdates.org/package/google_chrome/stable/main/base/google-chrome-stable
 # Linux/amd64 only

factory/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Change log
 
+## 5.11.3
+
+- Implement PGP key import checks for Node.js and restore the keyserver order to use hkps://keys.openpgp.org first with fallback to keyserver.ubuntu.com. Addressed in [#1380](https://github.com/cypress-io/cypress-docker-images/issues/1380).
+
 ## 5.11.2
 
 - Load PGP keys for Node.js from keyserver.ubuntu.com with fallback to hkps://keys.openpgp.org, reversing the previous order. Addresses [#1375](https://github.com/cypress-io/cypress-docker-images/issues/1375) and [#1376](https://github.com/cypress-io/cypress-docker-images/issues/1376).

factory/installScripts/node/default.sh

@@ -36,8 +36,8 @@ ARCH= && dpkgArch="$(dpkg --print-architecture)" \
       A363A499291CBBC940DD62E41F10027AF002F8B0 \
       C0D6248439F1D5604AAFFB4021D900FFDB233756 \
     ; do \
-      gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key"  || \
-      gpg --batch --keyserver hkps://keys.openpgp.org $keyserverOptions --recv-keys "$key" ; \
+      { gpg --batch --keyserver hkps://keys.openpgp.org $keyserverOptions --recv-keys "$key" && gpg --batch --fingerprint "$key" ; } ||
+      { gpg --batch --keyserver keyserver.ubuntu.com --recv-keys "$key" && gpg --batch --fingerprint "$key" ; } ; \
     done \
     && curl -fsSLO --compressed "https://nodejs.org/dist/v$1/node-v$1-linux-$ARCH.tar.xz" \
     && curl -fsSLO --compressed "https://nodejs.org/dist/v$1/SHASUMS256.txt.asc" \