Can't install node@24, gpg key import fails

[willmruzek]

I can't seem to install node@24. It seems some GPG keys won't import to my agent.

Send help.

❯ mise dr
version: 2025.10.19 macos-arm64 (2025-10-28)
activated: yes
shims_on_path: no
self_update_available: yes

❯ mise use --global --verbose node@24
DEBUG ARGS: /Users/mruzekw/.local/bin/mise use --global --verbose node@24
DEBUG config: ~/Desktop/cursor-ks/.tool-versions
DEBUG install_some_versions: node@24
INFO  node@24.11.0    install
DEBUG NodePlugin { ba: BackendArg(node -> core:node) }: we will fetch a precompiled version
INFO  node@24.11.0    download node-v24.11.0-darwin-arm64.tar.gz
DEBUG GET Downloading https://nodejs.org/dist/v24.11.0/node-v24.11.0-darwin-arm64.tar.gz to ~/.local/share/mise/downloads/node/24.11.0/node-v24.11.0-darwin-arm64.tar.gz
DEBUG GET https://nodejs.org/dist/v24.11.0/node-v24.11.0-darwin-arm64.tar.gz
DEBUG starting new connection: https://nodejs.org/
DEBUG connecting to [2606:4700:10::6814:1fc]:443
DEBUG connected to [2606:4700:10::6814:1fc]:443
DEBUG GET https://nodejs.org/dist/v24.11.0/node-v24.11.0-darwin-arm64.tar.gz 200 OK
DEBUG pooling idle connection for ("https", nodejs.org)
DEBUG GET Downloading https://nodejs.org/dist/v24.11.0/SHASUMS256.txt to ~/.local/share/mise/downloads/node/24.11.0/SHASUMS256.txt
DEBUG GET https://nodejs.org/dist/v24.11.0/SHASUMS256.txt
DEBUG reuse idle connection for ("https", nodejs.org)
DEBUG GET https://nodejs.org/dist/v24.11.0/SHASUMS256.txt 200 OK
DEBUG pooling idle connection for ("https", nodejs.org)
DEBUG GET Downloading https://nodejs.org/dist/v24.11.0/SHASUMS256.txt.sig to ~/.local/share/mise/downloads/node/24.11.0/SHASUMS256.asc
DEBUG GET https://nodejs.org/dist/v24.11.0/SHASUMS256.txt.sig
DEBUG reuse idle connection for ("https", nodejs.org)
DEBUG pooling idle connection for ("https", nodejs.org)
DEBUG GET https://nodejs.org/dist/v24.11.0/SHASUMS256.txt.sig 200 OK
DEBUG $ gpg --quiet --import
gpg: key 0x770F7A9A5AE15600: no valid user IDs
gpg: key 0xC43CEC45C17AB93C: no valid user IDs
ERROR gpg failed
Error:
   0: Failed to install core:node@24:
         0: gpg exited with non-zero status: exit code 2

      Location:
         src/cmd.rs:488

      Backtrace omitted. Run with RUST_BACKTRACE=1 environment variable to display it.
      Run with RUST_BACKTRACE=full to include source snippets.

Location:
   src/toolset/mod.rs:272

Version:
   2025.10.19 macos-arm64 (2025-10-28)

Backtrace omitted. Run with RUST_BACKTRACE=1 environment variable to display it.
Run with RUST_BACKTRACE=full to include source snippets.

[willmruzek]

The keys were failing to import because they only used SHA-1 sig algos.

I tinkered with my gpg.conf and gpg-agent.conf, but I don't think that's what made it work.
In both cases, my gpg v2.4.8 config blocked SHA-1 sigs by default.

It did succeed eventually, but with a different key. It was the same command (mise use --global --verbose node@24), and it attempted to install the same node version (v24.11.0).

I wish I had a more definitive issue as to what happened. Maybe some info would help others tell us why.

The output of the successful install is here:

❯ mise use --global --verbose node@24
DEBUG ARGS: /Users/mruzekw/.local/bin/mise use --global --verbose node@24
DEBUG config: ~/Desktop/cursor-ks/.tool-versions
DEBUG install_some_versions: node@24
INFO  node@24.11.0    install
DEBUG NodePlugin { ba: BackendArg(node -> core:node) }: we will fetch a precompiled version
INFO  node@24.11.0    download node-v24.11.0-darwin-arm64.tar.gz
DEBUG GET Downloading https://nodejs.org/dist/v24.11.0/node-v24.11.0-darwin-arm64.tar.gz to ~/.local/share/mise/downloads/node/24.11.0/node-v24.11.0-darwin-arm64.tar.gz
DEBUG GET https://nodejs.org/dist/v24.11.0/node-v24.11.0-darwin-arm64.tar.gz
DEBUG starting new connection: https://nodejs.org/
DEBUG connecting to 104.20.1.252:443
DEBUG connected to 104.20.1.252:443
DEBUG GET https://nodejs.org/dist/v24.11.0/node-v24.11.0-darwin-arm64.tar.gz 200 OK
DEBUG pooling idle connection for ("https", nodejs.org)
DEBUG GET Downloading https://nodejs.org/dist/v24.11.0/SHASUMS256.txt to ~/.local/share/mise/downloads/node/24.11.0/SHASUMS256.txt
DEBUG GET https://nodejs.org/dist/v24.11.0/SHASUMS256.txt
DEBUG reuse idle connection for ("https", nodejs.org)
DEBUG GET https://nodejs.org/dist/v24.11.0/SHASUMS256.txt 200 OK
DEBUG pooling idle connection for ("https", nodejs.org)
DEBUG GET Downloading https://nodejs.org/dist/v24.11.0/SHASUMS256.txt.sig to ~/.local/share/mise/downloads/node/24.11.0/SHASUMS256.asc
DEBUG GET https://nodejs.org/dist/v24.11.0/SHASUMS256.txt.sig
DEBUG reuse idle connection for ("https", nodejs.org)
DEBUG pooling idle connection for ("https", nodejs.org)
DEBUG GET https://nodejs.org/dist/v24.11.0/SHASUMS256.txt.sig 200 OK
DEBUG $ gpg --quiet --import
DEBUG $ gpg --quiet --trust-model always --verify /Users/mruzekw/.local/share/mise/downloads/node/24.11.0/SHASUMS256.asc /Users/mruzekw/.local/share/mise/downloads/node/24.11.0/SHASUMS256.txt
gpg: Signature made Tue Oct 28 13:00:12 2025 EDT
gpg:                using RSA key C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C
gpg: Good signature from "Richard Lau <rlau@redhat.com>" [unknown]
Primary key fingerprint: C82F A3AE 1CBE DC6B E46B  9360 C43C EC45 C17A B93C
INFO  node@24.11.0    checksum node-v24.11.0-darwin-arm64.tar.gz
DEBUG NodePlugin { ba: BackendArg(node -> core:node) }: successfully downloaded node archive
INFO  node@24.11.0    extract node-v24.11.0-darwin-arm64.tar.gz
DEBUG NodePlugin { ba: BackendArg(node -> core:node) }: extracting precompiled node
DEBUG tar -xf /Users/mruzekw/.local/share/mise/downloads/node/24.11.0/node-v24.11.0-darwin-arm64.tar.gz -C /Users/mruzekw/.local/share/mise/installs/node/24.11.0
DEBUG NodePlugin { ba: BackendArg(node -> core:node) }: precompiled node extraction was successful
DEBUG NodePlugin { ba: BackendArg(node -> core:node) }: checking installation is working as expected
INFO  node@24.11.0    node -v
DEBUG $ ~/.local/share/mise/installs/node/24.11.0/bin/node -v
INFO  node@24.11.0    v24.11.0
INFO  node@24.11.0    npm -v
DEBUG $ ~/.local/share/mise/installs/node/24.11.0/bin/npm -v
INFO  node@24.11.0    11.6.1
INFO  node@24.11.0  ✓ installed
DEBUG config: ~/Desktop/cursor-ks/.tool-versions
DEBUG [core:node@24.11.0] list_bin_paths: ["/Users/mruzekw/.local/share/mise/installs/node/24.11.0/bin"]
WARN  node is defined in ~/Desktop/cursor-ks/.tool-versions which overrides the global config (~/.config/mise/config.toml)
DEBUG config: ~/Desktop/cursor-ks/.tool-versions
DEBUG config: ~/.config/mise/config.toml
mise ~/.config/mise/config.toml tools: node@24.11.0

Key that failed

Key ID: 0x770F7A9A5AE15600
Fingerprint: 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
User ID: Michaël Zasso (Targos) <targos@protonmail.com>
Self-sig digest: algo 2 → SHA-1
Subkey binding digest: algo 2 → SHA-1

Key that worked

Key ID: 0xC43CEC45C17AB93C
Fingerprint: C82FA3AE1CBE...C43CEC45C17AB93C
User ID: Richard Lau <richard.lau@ibm.com>
Self-sig digests: SHA-512 (10) and SHA-1 (2)
Subkey binding: SHA-512 (10)

gpg.conf

# --------------------------------------------------------------------
# GPG configuration
# --------------------------------------------------------------------

# --- UX improvements ---
# Always show long key IDs and fingerprints for clarity
keyid-format 0xlong
with-fingerprint

# List fingerprints for subkeys too
with-subkey-fingerprint

# Display human-readable key trust info
list-options show-uid-validity
verify-options show-uid-validity

# --- Cryptographic preferences ---
# Use modern symmetric algorithms
personal-cipher-preferences AES256 AES192 AES

# Prefer strong digest algorithms when signing
personal-digest-preferences SHA512 SHA384 SHA256
cert-digest-algo SHA256

# Use modern compression
personal-compress-preferences ZLIB BZIP2 ZIP Uncompressed

# Explicitly advertise modern preferences in new keys
default-preference-list SHA512 SHA384 SHA256 AES256 AES192 AES ZLIB BZIP2 ZIP Uncompressed

# --- Behavior & security ---
# Always use the GPG agent (default in recent versions)
use-agent

# Require cross-certification for subkeys (prevents certain attacks)
require-cross-certification

# Lock memory to prevent swapping secret data (if supported)
require-secmem

# -- Legacy compatibility (uncomment only when necessary) --
# allow-weak-digest-algos
# weak-digest SHA1

# --- Optional: keyserver setup (for convenience only) ---
# You can comment these out if you never fetch keys directly
# keyserver hkps://keys.openpgp.org
# keyserver hkps://keyserver.ubuntu.com

# --- Optional: IPv4 fallback for flaky networks ---
# Uncomment if you often see "No route to host" from keyservers
# keyserver-options prefer-ipv4

gpg-agent.conf

# -------------------------------------------------------------------
# GPG Agent Configuration
# -------------------------------------------------------------------

# Cache passphrases for up to 8 hours (28800 seconds).
# This means you won’t be prompted for your GPG key’s passphrase again
# during that window, unless you restart the agent.

default-cache-ttl 28800
max-cache-ttl 28800

# Prevent storing passphrases in any external system keychain
# (like macOS Keychain or KDE Wallet). Keeps caching internal to gpg-agent.

no-allow-external-cache

# Specify which pinentry program to use for passphrase prompts.
# On macOS, pinentry-mac provides a native GUI dialog.

pinentry-program <path/to/pinentry>

[MikkCZ]

I am facing the same problem, if I use mise install --raw node@24. It's also for 22 and 20 versions. If I drop the --raw, it works.

[michaelPotter]

I was ran into this as well. I resolved it by updating mise per this discussion: Dokploy/dokploy#2291 I was on a very old release

[anodynos]

This issue still persists:

PS>  mise use --global node@24
mise WARN  gpg not found, skipping verification
mise C:\Users\agelo\.config\mise\config.toml tools: node@24.13.0

PS>  mise -v
2026.1.9 windows-x64 (2026-01-28)

I guess it is safe to use this node version? Anyway, for now...! But any ideas when this is going to be fixed?