Install script fails if gpg is not available and $YARN_GPG is not set to no

[BanzaiMan]

What is the current behavior?

When gpg is not available and $YARN_GPG is not set to no, the installation with the script fails

If the current behavior is a bug, please provide the steps to reproduce.

Remove gpg from $PATH and execute:

curl -o- -L https://yarnpkg.com/install.sh | bash

What is the expected behavior?

Installation succeeds

Please mention your node.js, yarn and operating system version.

Not relevant.

---

Analysis

The offending part is here:

yarn/scripts/install-latest.sh

Lines 34 to 38 in 2a4a56f

	# Check if GPG is installed
	command -v gpg >/dev/null 2>&1 || (
	printf "$yellow> WARNING: GPG is not installed, integrity can not be verified!$reset\n"
	return
	)

  command -v gpg >/dev/null 2>&1 || (
    printf "$yellow> WARNING: GPG is not installed, integrity can not be verified!$reset\n"
    return
  )

return does not get out of the function yarn_verify_integrity.

Instead, it should be more complete with if:

  if [[ -z "$(command -v gpg)" ]]; then
    printf "$yellow> WARNING: GPG is not installed, integrity can not be verified!$reset\n"
    return
  fi

[Daniel15]

Oops, my mistake. Thanks @BanzaiMan

[maximelafarie]

I still run into this warning while upgrading.

curl -o- -L https://yarnpkg.com/install.sh | bash

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  6875    0  6875    0     0  17131      0 --:--:-- --:--:-- --:--:-- 17144
Installing Yarn!
/Users/lafarie/.yarn/bin/yarn
> Downloading tarball...

[1/2]: https://yarnpkg.com/latest.tar.gz --> /var/folders/gl/hzn4_ptd2y710rnxmx0__4y00000gn/T/yarn.tar.gz.XXXXXXXXXX.0V6JALoB
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    90  100    90    0     0    169      0 --:--:-- --:--:-- --:--:--   169
100   608    0   608    0     0    350      0 --:--:--  0:00:01 --:--:--  1223
100  864k  100  864k    0     0   250k      0  0:00:03  0:00:03 --:--:--  623k

[2/2]: https://yarnpkg.com/latest.tar.gz.asc --> /var/folders/gl/hzn4_ptd2y710rnxmx0__4y00000gn/T/yarn.tar.gz.XXXXXXXXXX.0V6JALoB.asc
100    94  100    94    0     0    696      0 --:--:-- --:--:-- --:--:--   696
100   612    0   612    0     0   1364      0 --:--:-- --:--:-- --:--:--  1364
100  1028  100  1028    0     0   1599      0 --:--:-- --:--:-- --:--:-- 1003k
> WARNING: GPG is not installed, integrity can not be verified!
> Extracting to ~/.yarn...
> Adding to $PATH...
> We've added the following to your /Users/lafarie/.zshrc
> If this isn't the profile of your current shell then please add the following to your correct profile:

export PATH="$HOME/.yarn/bin:$PATH"

> Successfully installed Yarn 1.2.1! Please open another terminal where the `yarn` command will now be available.

[Daniel15]

@maximelafarie - I don't see any errors in your output? Seems like the installer worked?

[maximelafarie]

@Daniel15 You're right, that's just a warning 😅

[Daniel15]

Yeah it's just a warning. To avoid it, you should install GPG. Sent from my phone.

…

On Oct 14, 2017 1:39 AM, "Maxime Lafarie" ***@***.***> wrote: @Daniel15 <https://github.com/daniel15> You're right, that's just a warning 😅 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2012 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAFnHTo5RlFUtnXGpJqbDaOoUxVHu59Tks5sr3YkgaJpZM4K69Jd> .

[doublesharp]

To possibly save someone a Google search: brew install gpg

[njlr]

In my case (Travis CI + Windows):

choco install gpg4win-vanilla -y

[mattclegg]

And for alpine:
apk add --no-cache gnupg

[letallan]

To possibly save someone a Google search: brew install gpg

Right now it's brew install gnupg