Unable to install node 10.5.0 about asdf-nodejs HOT 13 CLOSED

I think the issue is caused by the fact that 10.5.0 is signed by Michaël Zasso, but import-release-team-keyring does not list his (current?) key. Manually adding it to gpg solved the issue for me (taken from nodejs release-team:

❯ gpg --keyserver pool.sks-keyservers.net --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
❯ asdf install nodejs 10.5.0

from asdf-nodejs.

Try to update asdf-nodejs plugin itself first and then update release keys:

asdf plugin-update nodejs
bash ~/.asdf/plugins/nodejs/bin/import-release-team-keyring
asdf install nodejs 10.5.0

from asdf-nodejs.

I submitted a PR that fixes the scripts. Just have to wait for approval.

from asdf-nodejs.

As a temp workaround, I set the env var NODEJS_CHECK_SIGNATURES=no and it worked fine.
Obviously this negates the whole signing key security, but it at least allows you to install ;)

from asdf-nodejs.

I confirm ... Michaël Zasso's key (8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600) is missing from the import-release-team-keys script, while former release team member Italo A. Casas is still included (56730D5401028683275BD23C23EFEFE93C4CFFFE)

Fixing that script and running it did get the right keys into my system and then the install verify worked fine.

from asdf-nodejs.

The keys are hardcoded in this project: https://github.com/asdf-vm/asdf-nodejs/blob/master/bin/import-release-team-keyring#L6-L13

So, it is the responsibility of this plugin to maintain the current list. A couple options I see:

1. Approach the nodejs team about providing this information in a basic web service format
2. Build a webservice that crawls/or events on merges to the nodejs readme and updates the webservice accordingly.
3. continue to update manually here.

from asdf-nodejs.

I have the same problem and tried getting the list of keys from nodejs repo instead: https://github.com/nodejs/node#release-team . The list is complete but I still couldn't install nodejs properly in my machine. This is the recent output in my console:

Wai-Yans-Macbook-Pro% asdf install nodejs v10.5.0
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  6738    0  6738    0     0   5018      0 --:--:--  0:00:01 --:--:--  5020
gpg: no valid OpenPGP data found.
gpg: the signature could not be verified.
Please remember that the signature file (.sig or .asc)
should be the first file given on the command line.
Authenticity of checksum file can not be assured! Please be sure to check the README of asdf-nodejs in case you did not yet bootstrap trust. If you already did that then that is the point to become SUSPICIOUS! There must be a reason why this is failing. If you are installing an older NodeJS version you might need to import OpenPGP keys of previous release managers. Exiting.

from asdf-nodejs.

I adjusted the import-release-team-keys script and ran it and I get a gpg: keyserver receive failed: No data for every key.

Probably another problem but maybe someone has an idea.

from asdf-nodejs.

Is there something in asdf-nodejs that needs to change to fix this issue? I'm not a regular Node.JS user myself so it's not obvious to me what is wrong here.

from asdf-nodejs.

If someone still have this issue, but with node 10.4.0 (asdf version 0.6.2),
I solved it with following:

gpg --keyserver ipv4.pool.sks-keyservers.net --recv-keys C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8

It's a key form Myles Borins.

Actually, I had to manually install all keys form that PR - link, but I think, that helping one was only key mentioned above.

$ asdf install nodejs 10.4.0
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  3856    0  3856    0     0   9427      0 --:--:-- --:--:-- --:--:--  9404
gpg: Signature made Wed Jun  6 14:25:17 2018 UTC
gpg:                using RSA key 0EFFE1BCEFD9C84E3D098152933B01F40B5CA946
gpg: Good signature from "Myles Borins <[email protected]>" [unknown]
gpg:                 aka "Myles Borins <[email protected]>" [unknown]
gpg:                 aka "Myles Borins <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: C4F0 DFFF 4E8C 1A82 3640  9D08 E73B C641 CC11 F4C8
     Subkey fingerprint: 0EFF E1BC EFD9 C84E 3D09  8152 933B 01F4 0B5C A946
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 17.4M  100 17.4M    0     0  9601k      0  0:00:01  0:00:01 --:--:-- 9596k
node-v10.4.0-linux-x64.tar.gz: OK

from asdf-nodejs.

Same with node-js 11.10.1

from asdf-nodejs.

@lyo5ha if you've found another key that needs to be added feel free to create a PR to add it to the list in https://github.com/asdf-vm/asdf-nodejs/blob/master/bin/import-release-team-keyring

from asdf-nodejs.

I had to first brew install gpg, then @shvetsovdm's answer worked like a charm for me.

from asdf-nodejs.