Repository navigation
Unable to Verify Signature of Version 10.23.0 #35850
Description
- Version: 10.23.0:
- Platform: Linux 64-bit:
What steps will reproduce the bug?
Running the following script:
#!/usr/bin/bash
curl -O https://nodejs.org/dist/v10.23.0/SHASUMS256.txt
curl -O https://nodejs.org/dist/v10.23.0/SHASUMS256.txt.sig
gpg --verify SHASUMS256.txt.sig SHASUMS256.txtCauses this error message:
gpg: Signature made Tue 27 Oct 2020 05:02:23 PM CET
gpg: using RSA key C43CEC45C17AB93C
gpg: Can't check signature: No public key
How often does it reproduce? Is there a required condition?
It always happens
What is the expected behavior?
The verification should work.
What do you see instead?
see error message above
Additional information
The RSA key C43CEC45C17AB93C cannot be obtained through keyserver.ubuntu.com
Activity
aduh95 commentedon Oct 28, 2020
@nodejs/releasers
richardlau commentedon Oct 28, 2020
I uploaded my key to the sks-keyservers.net pool (as per the recommendation) months ago (#34397 (review)). I have no idea if
keyserver.ubuntu.comis in that pool for it to replicate across but if it isn't then you're not going to be guaranteed to find the release keys there.FWIW I've manually sent my key to
keyserver.ubuntu.comso it should be found there now.patrickbucher commentedon Oct 28, 2020
@richardlau Thanks, that worked fine!