fix: secure PostgreSQL APT key installation in dockerfile

[erikburt]

• Switches off of apt-key add as that is deprecated, and less secure
• Uses a per-repo keyring, and verifies the GPG key

Testing

Builds are successful: https://github.com/smartcontractkit/chainlink/actions/runs/25699217695?pr=22391

Notes

Sonarqube is complaining with:

RUN curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc
^
Not enforcing HTTPS here might allow for redirections to insecure websites. Make sure it is safe here.

This is not that relevant as we are validating the fetched key with a known/static fingerprint baked into our Dockerfile. This means that we technically don't care if it ends up redirecting to http, because the key is still verified.

---

DX-4135

[github-actions]

✅ No conflicts with other open PRs targeting develop

[trunk-io]

     

View Full Report ↗︎ ⋅ Docs

[cl-sonarqube-production]

Quality Gate failed

Failed conditions
2 Security Hotspots

See analysis details on SonarQube

[Copilot]

Pull request overview

Risk Rating: MEDIUM — Changes affect how production/testing Docker images add and trust an external APT repository (PostgreSQL), which can impact build reliability and supply-chain trust.

This PR updates the Chainlink Docker build to install the PostgreSQL APT signing key without apt-key, using a dedicated keyring and a fingerprint check to improve security.

Changes:

• Replace deprecated apt-key add usage with a per-repo keyring under /usr/share/keyrings.
• Add a GPG fingerprint check for the PostgreSQL repository key.
• Switch the PGDG APT source URL from http to https and use signed-by in the source entry.

Scrupulous human review recommended (security-sensitive):

• The key download + dearmor + fingerprint validation pipeline, to ensure it strictly enforces the intended trust model (only the expected key(s) are trusted).
• The resulting keyring permissions/format and the signed-by wiring, to ensure apt-get update works reliably in CI/build environments.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
core/chainlink.Dockerfile	Reworks PGDG key installation to use a dedicated keyring + fingerprint validation and signed-by.
plugins/chainlink.Dockerfile	Mirrors the same PGDG keyring + fingerprint + signed-by approach for the plugins image.