Yarn: Install script fails if `gpg` is not available and `$YARN_GPG` is not set to `no`

Created on 23 Nov 2016 · 8Comments · Source: yarnpkg/yarn

What is the current behavior?

When gpg is not available and $YARN_GPG is not set to no, the installation with the script fails

If the current behavior is a bug, please provide the steps to reproduce.

Remove gpg from $PATH and execute:

curl -o- -L https://yarnpkg.com/install.sh | bash

What is the expected behavior?

Installation succeeds

Please mention your node.js, yarn and operating system version.

Not relevant.

Analysis

The offending part is here: https://github.com/yarnpkg/yarn/blob/2a4a56ff8a79747cbe322c738736fc53a072d98b/scripts/install-latest.sh#L34-L38

  command -v gpg >/dev/null 2>&1 || (
    printf "$yellow> WARNING: GPG is not installed, integrity can not be verified!$reset\n"
    return
  )

return does not get out of the function yarn_verify_integrity.

Instead, it should be more complete with if:

  if [[ -z "$(command -v gpg)" ]]; then
    printf "$yellow> WARNING: GPG is not installed, integrity can not be verified!$reset\n"
    return
  fi

cat-bug

Source

BanzaiMan

Most helpful comment

To possibly save someone a Google search: brew install gpg

doublesharp on 15 Oct 2017

👍37 ❤12

All 8 comments

Oops, my mistake. Thanks @BanzaiMan

Daniel15 on 23 Nov 2016

❤1

I still run into this warning while upgrading.

curl -o- -L https://yarnpkg.com/install.sh | bash

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  6875    0  6875    0     0  17131      0 --:--:-- --:--:-- --:--:-- 17144
Installing Yarn!
/Users/lafarie/.yarn/bin/yarn
> Downloading tarball...

[1/2]: https://yarnpkg.com/latest.tar.gz --> /var/folders/gl/hzn4_ptd2y710rnxmx0__4y00000gn/T/yarn.tar.gz.XXXXXXXXXX.0V6JALoB
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    90  100    90    0     0    169      0 --:--:-- --:--:-- --:--:--   169
100   608    0   608    0     0    350      0 --:--:--  0:00:01 --:--:--  1223
100  864k  100  864k    0     0   250k      0  0:00:03  0:00:03 --:--:--  623k

[2/2]: https://yarnpkg.com/latest.tar.gz.asc --> /var/folders/gl/hzn4_ptd2y710rnxmx0__4y00000gn/T/yarn.tar.gz.XXXXXXXXXX.0V6JALoB.asc
100    94  100    94    0     0    696      0 --:--:-- --:--:-- --:--:--   696
100   612    0   612    0     0   1364      0 --:--:-- --:--:-- --:--:--  1364
100  1028  100  1028    0     0   1599      0 --:--:-- --:--:-- --:--:-- 1003k
> WARNING: GPG is not installed, integrity can not be verified!
> Extracting to ~/.yarn...
> Adding to $PATH...
> We've added the following to your /Users/lafarie/.zshrc
> If this isn't the profile of your current shell then please add the following to your correct profile:

export PATH="$HOME/.yarn/bin:$PATH"

> Successfully installed Yarn 1.2.1! Please open another terminal where the `yarn` command will now be available.

maximelafarie on 13 Oct 2017

@maximelafarie - I don't see any errors in your output? Seems like the installer worked?

Daniel15 on 13 Oct 2017

@Daniel15 You're right, that's just a warning 😅

maximelafarie on 13 Oct 2017

Yeah it's just a warning. To avoid it, you should install GPG.

Sent from my phone.

On Oct 14, 2017 1:39 AM, "Maxime Lafarie" notifications@github.com wrote:

@Daniel15 https://github.com/daniel15 You're right, that's just a
warning 😅

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/yarnpkg/yarn/issues/2012#issuecomment-336472186, or mute
the thread
https://github.com/notifications/unsubscribe-auth/AAFnHTo5RlFUtnXGpJqbDaOoUxVHu59Tks5sr3YkgaJpZM4K69Jd
.