keys: add key for @sxa

[sxa]

Final checklist point in nodejs/Release#733

Description

Motivation and Context

Testing Details

Example Output(if appropriate)

Types of changes

• Documentation
• Version change (Update, remove or add more Node.js versions)
• Variant change (Update, remove or add more variants, or versions of variants)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Other (none of the above)

Checklist

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING.md document.
• All new and existing tests passed.

[MikeMcC399]

@sxa

Congratulations on your new appointment and your additional "hat"!

Changes in keys aren't tested in CI immediately, so I went through the following test:

git clone https://github.com/nodejs/docker-node
cd docker-node
git remote add sxa https://github.com/sxa/docker-node
git fetch sxa
git switch sxa_keys
./update.sh
cd 26/trixie
docker build --progress plain -t test-sxa .

#8 2.299 + gpg --batch --keyserver hkps://keys.openpgp.org --recv-keys 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD
#8 2.534 gpg: key E4A7D232B936D2FD: public key "Stewart X Addison <sxa@ibm.com>" imported
#8 2.538 gpg: Total number processed: 1
#8 2.538 gpg:               imported: 1
#8 2.538 + gpg --batch --fingerprint 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD
#8 2.542 pub   ed25519 2026-06-29 [SC] [expires: 2028-06-28]
#8 2.542       655F 3B5C 1FB3 FA8D 1A0C  A6BD E4A7 D232 B936 D2FD
#8 2.542 uid           [ unknown] Stewart X Addison <sxa@ibm.com>
#8 2.542 sub   cv25519 2026-06-29 [E] [expires: 2028-06-28]

I don't see any issues there and I see that the key is also available in https://keyserver.ubuntu.com as well.

[aduh95]

You'd need to run ./update.sh so your key gets integrated in the actual dockerfiles – which should kick off the CI testing

[MikeMcC399]

You'd need to run ./update.sh so your key gets integrated in the actual dockerfiles – which should kick off the CI testing

Testing locally is fine. I did run ./update.sh locally.

Changing Dockerfiles in the repo for minor changes like this has been a bit awkward in the past because it triggers PR creation, causing noise.

[aduh95]

Changing Dockerfiles in the repo for minor changes like this has been a bit awkward in the past because it triggers PR creation, causing noise.

Hum but wouldn't that mean that any release signed with @sxa key would fail until the Dockerfiles are updated?

[MikeMcC399]

Hum but wouldn't that mean that any release signed with @sxa key would fail until the Dockerfiles are updated?

The Dockerfiles get automatically updated when there's a release, because a release automatically runs ./update.sh. I'm sure it will be OK, but we'll keep a close eye on it when Stuart signs a release.

[MikeMcC399]

PR #2562 for Node.js 26.5.0 confirms that the key for @sxa gets pulled in automatically as needed when update.sh re-writes Dockerfiles for a new release.