Debian repository setup script stores GPG key in wrong directory and installs `apt-transport-https`

[dhs-rec]

Describe your bug
On https://deb.nodesource.com/, the user is instructed to download and execute a script for setting up the package repository together with its GPG key. The script stores the downloaded key in /usr/share/keyrings which, according to this Debian wiki page, is wrong. It states:

If future updates to the certificate will be managed by an apt/dpkg package as recommended below, then it SHOULD be downloaded into /usr/share/keyrings using the same filename that will be provided by the package. If it will be managed locally , it SHOULD be downloaded into /etc/apt/keyrings instead.

I couldn't find a package that manages the key going forward, so it should be stored in /etc/apt/keyrings. Please either fix the script to store the key in the correct location or provide a package for managing the key.

The script also installs apt-transport-https which is a dummy since at least Debian Stretch. Please stop installing that useless package.

Distribution Information:

• OS: Debian, Ubuntu
• Version: Any supported

Node Version:

• Node: >=18

To Reproduce
Steps to reproduce the behavior:

1. Follow instructions from https://deb.nodesource.com/

Expected behavior

1. The GPG key is stored in /etc/apt/keyrings OR an additional package is installed that manages the key in /usr/share/keyrings
2. The dummy package apt-transport-https is NOT installed

[Spudz76]

Also while fixing that, please regenerate the keyfile so it's signed with SHA256 (which seems to have only been done for RPM)

   Signing key on 6F71F525282841EEDAF851B42F59B5F99B1BE0B4 is not bound:
              No binding signature at time 2025-04-22T16:41:09Z
     because: Policy rejected non-revocation signature (PositiveCertification) requiring second pre-image resistance
     because: SHA1 is not considered secure since 2026-02-01T00:00:00Z

This method worked well for regenerating my own private repo keys (although it's for "RPM"). Using the add-one-second date hack also makes it so none of the existing signatures have to be redone (all existing packages will "just work").