Node install fails at gpg verification when using --raw

[baylisscg]

I was trying to debug some behaviour in mise-action and discovered that you can't install node if you set --raw. A bit of messing around later and I discovered I can replicate it on macOS too.

❯ env RUST_BACKTRACE=full  MISE_VERBOSE=1 mise --raw install node@20
DEBUG ARGS: mise --raw install node@20
DEBUG config: ~/Projects/connectup/website/mise.local.toml
DEBUG config: ~/Projects/connectup/website/mise.toml
DEBUG config: ~/Projects/connectup/website/.nvmrc
DEBUG config: ~/.config/mise/config.toml
DEBUG install_some_versions: node@20
INFO  node@20.18.3            install
INFO  node@20.18.3            download node-v20.18.3-darwin-arm64.tar.gz
DEBUG GET Downloading https://nodejs.org/dist/v20.18.3/node-v20.18.3-darwin-arm64.tar.gz to ~/.local/share/mise/downloads/node/20.18.3/node-v20.18.3-darwin-arm64.tar.gz
DEBUG GET https://nodejs.org/dist/v20.18.3/node-v20.18.3-darwin-arm64.tar.gz
DEBUG starting new connection: https://nodejs.org/
DEBUG GET https://nodejs.org/dist/v20.18.3/node-v20.18.3-darwin-arm64.tar.gz 200 OK
DEBUG GET Downloading https://nodejs.org/dist/v20.18.3/SHASUMS256.txt to ~/.local/share/mise/downloads/node/20.18.3/SHASUMS256.txt
DEBUG GET https://nodejs.org/dist/v20.18.3/SHASUMS256.txt
DEBUG GET https://nodejs.org/dist/v20.18.3/SHASUMS256.txt 200 OK
DEBUG GET Downloading https://nodejs.org/dist/v20.18.3/SHASUMS256.txt.sig to ~/.local/share/mise/downloads/node/20.18.3/SHASUMS256.asc
DEBUG GET https://nodejs.org/dist/v20.18.3/SHASUMS256.txt.sig
DEBUG GET https://nodejs.org/dist/v20.18.3/SHASUMS256.txt.sig 200 OK
DEBUG $ gpg --quiet --import
ERROR gpg failed
Error:
   0: failed to install core:node@20.18.3
   1: gpg exited with non-zero status: exit code 2

Location:
   src/cmd.rs:463

Version:
   2025.2.7 macos-arm64 (2025-02-19)

  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ BACKTRACE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
                                ⋮ 3 frames hidden ⋮
   4: mise::cmd::CmdLineRunner::on_error::h5d0db033480bd9a1
      at <unknown source file>:<unknown line>
   5: mise::cmd::CmdLineRunner::execute::h8009797f403f8f57
      at <unknown source file>:<unknown line>
   6: mise::gpg::add_keys_node::hdb38d508a2516780
      at <unknown source file>:<unknown line>
   7: mise::plugins::core::node::NodePlugin::fetch_tarball::h4064862f53ec4453
      at <unknown source file>:<unknown line>
   8: <mise::plugins::core::node::NodePlugin as mise::backend::Backend>::install_version_::h6c4ae7010a57429e
      at <unknown source file>:<unknown line>
   9: mise::backend::Backend::install_version::hf2bd08d77700447b
      at <unknown source file>:<unknown line>
  10: std::sys::backtrace::__rust_begin_short_backtrace::h0df306ee7334274b
      at <unknown source file>:<unknown line>
  11: core::ops::function::FnOnce::call_once{{vtable.shim}}::hbb75a49f5539a121
      at <unknown source file>:<unknown line>
  12: std::sys::pal::unix::thread::Thread::new::thread_start::ha1530855ce6ee203
      at <unknown source file>:<unknown line>
  13: __pthread_deallocate<unknown>
      at <unknown source file>:<unknown line>

Run with COLORBT_SHOW_HIDDEN=1 environment variable to disable frame filtering.

without --raw

❯ env RUST_BACKTRACE=full  MISE_VERBOSE=1 mise install node@20
DEBUG ARGS: mise install node@20
DEBUG config: ~/Projects/connectup/website/mise.local.toml
DEBUG config: ~/Projects/connectup/website/mise.toml
DEBUG config: ~/Projects/connectup/website/.nvmrc
DEBUG config: ~/.config/mise/config.toml
DEBUG install_some_versions: node@20
INFO  node@20.18.3            install
INFO  node@20.18.3            download node-v20.18.3-darwin-arm64.tar.gz
DEBUG GET Downloading https://nodejs.org/dist/v20.18.3/node-v20.18.3-darwin-arm64.tar.gz to ~/.local/share/mise/downloads/node/20.18.3/node-v20.18.3-darwin-arm64.tar.gz
DEBUG GET https://nodejs.org/dist/v20.18.3/node-v20.18.3-darwin-arm64.tar.gz
DEBUG starting new connection: https://nodejs.org/
DEBUG GET https://nodejs.org/dist/v20.18.3/node-v20.18.3-darwin-arm64.tar.gz 200 OK
DEBUG GET Downloading https://nodejs.org/dist/v20.18.3/SHASUMS256.txt to ~/.local/share/mise/downloads/node/20.18.3/SHASUMS256.txt
DEBUG GET https://nodejs.org/dist/v20.18.3/SHASUMS256.txt
DEBUG GET https://nodejs.org/dist/v20.18.3/SHASUMS256.txt 200 OK
DEBUG GET Downloading https://nodejs.org/dist/v20.18.3/SHASUMS256.txt.sig to ~/.local/share/mise/downloads/node/20.18.3/SHASUMS256.asc
DEBUG GET https://nodejs.org/dist/v20.18.3/SHASUMS256.txt.sig
DEBUG GET https://nodejs.org/dist/v20.18.3/SHASUMS256.txt.sig 200 OK
DEBUG $ gpg --quiet --import
DEBUG $ gpg --quiet --trust-model always --verify /Users/baylissc/.local/share/mise/downloads/node/20.18.3/SHASUMS256.asc /Users/baylissc/.local/share/mise/downloads/node/20.18.3/SHASUMS256.txt
gpg: Signature made Tue 11 Feb 00:53:23 2025 AEDT
gpg:                using RSA key CC68F5A3106FF448322E48ED27F5E38D5B0A215F
gpg: Good signature from "marco-ippolito <marcoippolito54@gmail.com>" [unknown]
INFO  node@20.18.3            checksum node-v20.18.3-darwin-arm64.tar.gz
INFO  node@20.18.3            extract node-v20.18.3-darwin-arm64.tar.gz
DEBUG tar -xf /Users/baylissc/.local/share/mise/downloads/node/20.18.3/node-v20.18.3-darwin-arm64.tar.gz -C /Users/baylissc/.local/share/mise/installs/node/20.18.3
INFO  node@20.18.3            node -v

Using the mise-action gives the same behaviour. Turning off GPG verification for node also works but that's a less optimal workaround.

For completeness:

❯ mise doctor
version: 2025.2.7 macos-arm64 (2025-02-19)
activated: yes
shims_on_path: no

build_info:
  Target: aarch64-apple-darwin
  Features: DEFAULT, NATIVE_TLS, OPENSSL, SELF_UPDATE
  Built: Wed, 19 Feb 2025 21:10:03 +0000
  Rust Version: rustc 1.84.0 (9fc6b4312 2025-01-07)
  Profile: release

shell:
  /opt/homebrew/bin/fish
  fish, version 3.7.1

dirs:
  cache: ~/Library/Caches/mise
  config: ~/.config/mise
  data: ~/.local/share/mise
  shims: ~/.local/share/mise/shims
  state: ~/.local/state/mise

config_files:
  ~/.config/mise/config.toml
  ~/[snip]/.nvmrc
  ~/[snip]/mise.toml
  ~/[snip]/mise.local.toml

ignored_config_files: (none)

backends:
  aqua
  asdf
  cargo
  core
  dotnet
  gem
  go
  npm
  pipx
  spm
  ubi
  vfox

plugins:

toolset:
  aqua:astral-sh/ruff@0.9.6
  aqua:astral-sh/uv@0.6.1
  aqua:gruntwork-io/terragrunt@0.73.7
  aqua:pnpm/pnpm@10.4.1
  core:node@20.18.3     (missing)
  core:python@3.13.2
  npm:husky@9.1.7
  npm:lint-staged@15.4.3
  npm:prettier@3.5.1

path:
  ~/[snip]/.venv/bin
  ~/[snip]/frontend/node_modules/.bin
  ~/.local/share/mise/installs/npm-husky/9.1.7/bin
  ~/.local/share/mise/installs/npm-lint-staged/15.4.3/bin
  ~/.local/share/mise/installs/npm-prettier/3.5.1/bin
  ~/.local/share/mise/installs/pnpm/10.4.1
  ~/.local/share/mise/installs/python/3.13.2/bin
  ~/.local/share/mise/installs/uv/0.6.1/uv-aarch64-apple-darwin
  ~/.local/share/mise/installs/ruff/0.9.6/ruff-aarch64-apple-darwin
  ~/.local/share/mise/installs/terragrunt/0.73.7
  ~/.local/bin
  ~/.cargo/bin
  ~/.volta/bin
  ~/Library/pnpm
  ~/Library/Application Support/JetBrains/Toolbox/scripts
  /opt/homebrew/bin
  /usr/local/bin
  /System/Cryptexes/App/usr/bin
  /usr/bin
  /bin
  /usr/sbin
  /sbin
  /var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin
  /var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin
  /var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin
  /Library/Apple/usr/bin
  /Applications/Postgres.app/Contents/Versions/latest/bin
  /Applications/iTerm.app/Contents/Resources/utilities

env_vars:
  MISE_SHELL=fish

settings:
  experimental         true  ~/.config/mise/config.toml
  python.uv_venv_auto  false ~/.config/mise/config.toml

No problems found

Closest discussion was #3768 but that was solved by a Windows interop setting and this is macOS and Linux

[weyert]

Yes, I am experienced this issue before but now it appears to work for newer Node.js versions but now instead I am getting issues when it tries to install nnpm instead. Using the asdf-nodejs-plugin instead of the core node plugin appears to work but than it complains about hooks.

[baylisscg]

v20.18.3 was released 10th Feb 2025 so it's "new" just not the current active LTS

[hcientist]

I wasn't using "raw" but for me, killing gpg-agent solved my issue (on macOS).