Node 16.18.0 fails PGP checksum (16.17.1 fine)

[cc-stjm]

I've seen from #321 that 16.18.0 was recently added, however when I try to install it I get a warning that the checksum cannot be validated. 16.17.1 works fine on the same setup.

# asdf plugin update nodejs
Updating nodejs...
Already on 'master'
Your branch is up to date with 'origin/master'.
# bash -c ./import-release-team-keyring 
gpg: key D7062848A1AB005C: public key "Beth Griggs <bgriggs@redhat.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: key 7434390BDBE9B9C5: public key "Colin Ihrig <cjihrig@gmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: key D3A89613643B6201: public key "Danielle Adams <adamzdanielle@gmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: key C97EC7A07EDE3FC1: public key "keybase.io/jasnell <jasnell@keybase.io>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: key 770F7A9A5AE15600: public key "Michaël Zasso (Targos) <targos@protonmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: key E73BC641CC11F4C8: public key "Myles Borins <myles.borins@gmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: key C43CEC45C17AB93C: public key "Richard Lau <rlau@redhat.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: key C273792F7D83545D: public key "Rod Vagg <rod@vagg.org>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: key F07496B3EB3C1762: public key "Ruben Bridgewater <ruben@bridgewater.de>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: key 97B01419BD92F80A: public key "Ruy Adorno <ruyadorno@hotmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1
gpg: key F13993A75599653C: public key "Shelley Vohr (security is major key) <shelley.vohr@gmail.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

# asdf install nodejs 16.17.1
node-v16.17.1-linux-x64.tar.gz: OK

Installing bower npm package... SUCCESS

Installing bower-npm-resolver npm package... SUCCESS

Installing npm-install-peers npm package... SUCCESS

Installing yarn npm package... SUCCESS

# asdf install nodejs 16.18.0
Authenticity of checksum file can not be assured! Please be sure to check the README of asdf-nodejs in case you did not yet import the needed PGP keys. Also, make sure the plugin is up-to-date by running `asdf plugin update nodejs`. If you already did that then that is the point to become SUSPICIOUS! There must be a reason why this is failing. If you are installing an older NodeJS version you might need to import OpenPGP keys of previous release managers. Exiting.

[augustobmoura]

We don't use GPG signature checks anymore, update asdf-nodejs to the latest version, and the problem should be fixed.

Try running:

asdf update
asdf plugin-update --all

[cc-stjm]

Thank you. In case anyone else stumbles across this:

• I am trying to use asdf from gitlab's license finder, which uses an old version of asdf - 0.7.8
• It seems to pull from a fork of asdf-nodejs - discovered using asdf plugin list --urls
• Attempting to re-point it to this repo fails due to Broken build process after recent update #276

I've documented this in a comment in https://gitlab.com/gitlab-org/gitlab/-/issues/300448

Apologies for the spam.