Skip to content

Conversation

@wouterlucas
Copy link
Contributor

We're a bit behind on pnpm versions and this causes issues with newer node installs and corepack. The issue is related to verifying the PNPM tarball signature, and it's failing because the signature in the TUF metadata cannot be validated—likely due to a key mismatch or expired/incomplete keyring used by Corepack:

Internal Error: Cannot find matching keyid: {"signatures":[{"sig":"MEUCIQDH6Kte1awtFvRUVsKWHtRaKuryH/0lm0Wswd29C+NdWAIgMxcudJ1cOlbnCh3oiFLkrQLua0vp6H+mGvycpY4TzxM=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"keys":[{"expires":null,"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256"

To work arround this I'm installing a pinned version of pnpm through corepack:

RUN corepack enable && corepack prepare [email protected] --activate

And removed the please use pnpm check script, its no longer needed. People can figure it out or they should read the readme.

@jfboeve jfboeve added this pull request to the merge queue Apr 3, 2025
Merged via the queue into main with commit 296a819 Apr 3, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants