From 76bfe518cb3d9f648bee8069ae53ad3769fbf1c6 Mon Sep 17 00:00:00 2001
From: oWretch <975588+oWretch@users.noreply.github.com>
Date: Sat, 3 Oct 2026 00:40:28 +0000
Subject: [PATCH] fix(node): Refresh inherited Yarn APT keyrings before
 dependencies

---
 src/node/devcontainer-feature.json          |  2 +-
 src/node/install.sh                         | 21 ++++++++++++++++++---
 test/node/refresh_inherited_yarn_keyring.sh | 13 +++++++++++++
 test/node/scenarios.json                    |  9 +++++++++
 4 files changed, 41 insertions(+), 4 deletions(-)
 create mode 100755 test/node/refresh_inherited_yarn_keyring.sh

diff --git a/src/node/devcontainer-feature.json b/src/node/devcontainer-feature.json
index 5e0970b2d..5e0b8063e 100644
--- a/src/node/devcontainer-feature.json
+++ b/src/node/devcontainer-feature.json
@@ -1,6 +1,6 @@
 {
     "id": "node",
-    "version": "2.1.0",
+    "version": "2.1.1",
     "name": "Node.js (via nvm), yarn and pnpm.",
     "documentationURL": "https://github.com/devcontainers/features/tree/main/src/node",
     "description": "Installs Node.js, nvm, yarn, pnpm, and needed dependencies.",
diff --git a/src/node/install.sh b/src/node/install.sh
index 0e277812e..dfc1a0968 100755
--- a/src/node/install.sh
+++ b/src/node/install.sh
@@ -198,15 +198,26 @@ find_version_from_git_tags() {
     echo "${variable_name}=${!variable_name}"
 }
 
+configure_yarn_apt_repository() (
+    set -e
+    local temporary_dir
+    temporary_dir=$(mktemp -d)
+    trap 'rm -rf "${temporary_dir}"' EXIT
+    curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg -o "${temporary_dir}/pubkey.gpg"
+    gpg --dearmor --yes -o "${temporary_dir}/yarn-archive-keyring.gpg" "${temporary_dir}/pubkey.gpg"
+    chmod 644 "${temporary_dir}/yarn-archive-keyring.gpg"
+    mkdir -p /etc/apt/keyrings
+    mv "${temporary_dir}/yarn-archive-keyring.gpg" /etc/apt/keyrings/yarn-archive-keyring.gpg
+    echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/yarn-archive-keyring.gpg] https://dl.yarnpkg.com/debian/ stable main" > /etc/apt/sources.list.d/yarn.list
+)
+
 install_yarn() {
     if [ "${ADJUSTED_ID}" = "debian" ] && [ "${INSTALL_YARN_USING_APT}" = "true" ]; then
         # for backward compatiblity with existing devcontainer features, install yarn
         # via apt-get on Debian systems
         if ! type yarn >/dev/null 2>&1; then
             # Import key safely (new method rather than deprecated apt-key approach) and install
-            mkdir -p /etc/apt/keyrings
-            curl -fsSL https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor --yes -o /etc/apt/keyrings/yarn-archive-keyring.gpg
-            echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/yarn-archive-keyring.gpg] https://dl.yarnpkg.com/debian/ stable main" > /etc/apt/sources.list.d/yarn.list
+            configure_yarn_apt_repository
             apt-get update
             apt-get -y install --no-install-recommends yarn
         else
@@ -271,6 +282,10 @@ if ( [ -n "${VERSION_CODENAME}" ] && [[ "bionic" = *"${VERSION_CODENAME}"* ]] )
 fi
 
 # Install dependencies
+if [ "${ADJUSTED_ID}" = "debian" ] && [ -f /etc/apt/sources.list.d/yarn.list ] && grep -q 'https://dl.yarnpkg.com/debian/' /etc/apt/sources.list.d/yarn.list; then
+    configure_yarn_apt_repository
+fi
+
 case ${ADJUSTED_ID} in
     debian)
         check_packages apt-transport-https curl ca-certificates tar gnupg2 dirmngr
diff --git a/test/node/refresh_inherited_yarn_keyring.sh b/test/node/refresh_inherited_yarn_keyring.sh
new file mode 100755
index 000000000..965ba8a41
--- /dev/null
+++ b/test/node/refresh_inherited_yarn_keyring.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -e
+
+source dev-container-features-test-lib
+
+check "node" node --version
+check "yarn" yarn --version
+check "readable Yarn keyring" test -r /etc/apt/keyrings/yarn-archive-keyring.gpg
+check "Yarn repository signature" bash -o pipefail -c 'curl -fsSL https://dl.yarnpkg.com/debian/dists/stable/InRelease | gpgv --keyring /etc/apt/keyrings/yarn-archive-keyring.gpg -'
+check "APT repository signatures" sudo apt-get -o APT::Update::Error-Mode=any update
+
+reportResults
\ No newline at end of file
diff --git a/test/node/scenarios.json b/test/node/scenarios.json
index 22f20bb48..0844aafff 100644
--- a/test/node/scenarios.json
+++ b/test/node/scenarios.json
@@ -1,4 +1,13 @@
 {
+    "refresh_inherited_yarn_keyring": {
+        "image": "mcr.microsoft.com/devcontainers/python:1.2.8-3.13-bookworm",
+        "features": {
+            "node": {
+                "version": "lts",
+                "installYarnUsingApt": true
+            }
+        }
+    },
     "install_node_debian_trixie": {
         "image": "debian:13",
         "features": {