FIX MS Package Signing Key issue #1353 to enable DevContainers after Feb-01-2026

.devcontainer/Dockerfile

@@ -7,6 +7,9 @@ SHELL ["/bin/bash", "-c"]
 
 USER root
 
+# Remove the Yarn repository (has expired GPG key and we don't use Yarn)
+RUN rm -f /etc/apt/sources.list.d/yarn.list 2>/dev/null || true
+
 # Install required system packages + ODBC prerequisites
 RUN apt-get update && apt-get install -y \
     sudo \
@@ -25,10 +28,11 @@ RUN apt-get update && apt-get install -y \
       ca-certificates \
       gnupg \
       lsb-release \
- && curl -sL https://packages.microsoft.com/config/debian/12/packages-microsoft-prod.deb \
-      -o packages-microsoft-prod.deb \
- && dpkg -i packages-microsoft-prod.deb \
- && rm packages-microsoft-prod.deb \
+ && curl -sL https://packages.microsoft.com/keys/microsoft.asc \
+ | gpg --dearmor \
+ > /usr/share/keyrings/microsoft-archive-keyring.gpg \
+ && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/microsoft-archive-keyring.gpg] https://packages.microsoft.com/debian/12/prod bookworm main" \
+ > /etc/apt/sources.list.d/microsoft.list \
  && apt-get update \
  && ACCEPT_EULA=Y apt-get install -y \
       msodbcsql18 \

.devcontainer/devcontainer_setup.sh

@@ -71,6 +71,13 @@ if [ -f "package.json" ]; then
 
     # Install Playwright browsers and system dependencies for E2E testing
     echo "📦 Installing Playwright browsers..."
+
+    # Remove third-party repos with SHA1 signature issues (rejected since 2026-02-01)
+    # Playwright deps come from Debian main repos, these aren't needed
+    sudo rm -f /etc/apt/sources.list.d/yarn.list \
+               /etc/apt/sources.list.d/nodesource.list \
+               /etc/apt/sources.list.d/microsoft.list 2>/dev/null || true
+
     npx playwright install --with-deps chromium
 
     echo "✅ Frontend dependencies installed."