[jdx]

https://entire.io/gh/jdx/mise/trails/551

mise is supposed to check node's signed SHASUMS256.txt before it trusts a download's checksum, but it only did this when the version string started with 2. So installing node 18, 19, 16 or any older release skipped signature verification without saying so, even though nodejs.org publishes SHASUMS256.txt.sig for those releases. The same check would also have stopped working once node reached 30.x.

Before:

$ MISE_DEBUG=1 mise install node@18.20.8 2>&1 | grep SHASUMS
GET https://nodejs.org/dist/v18.20.8/SHASUMS256.txt 200 OK

After:

$ MISE_DEBUG=1 mise install node@18.20.8 2>&1 | grep SHASUMS
GET https://nodejs.org/dist/v18.20.8/SHASUMS256.txt 200 OK
GET https://nodejs.org/dist/v18.20.8/SHASUMS256.txt.sig 200 OK

Now every node version is checked, unless node.gpg_verify (or the global gpg_verify) is false. The bundled node release keyring verifies real signatures from v0.10.48 through v25.0.0. A few early releases (for example 0.12.0, 4.0.0 and 5.12.0) never published a signature; those still install, with the existing gpg signature not found, skipping verification warning.

Migration: you do not need to change anything. If you use a mirror that has no signatures, or that answers the .sig request with something other than 404, older versions now behave the way 20+ already did. Set node.gpg_verify = false to turn the check off.

Validation: a new e2e test (e2e/core/test_node_gpg_verify) serves an 18.x mirror whose signature does not match. The install fails on main's behaviour and is now rejected at the signature check. I also did real installs of 18.20.8 and 5.12.0 from nodejs.org.

AI-assisted — Tool: Claude Code; model: anthropic/claude-opus-5-5; version: claude-code_2-1-289_agent.

🤖 Generated with Claude Code

---

Note

Medium Risk
Expands security-critical install verification to all Node versions; mirrors without valid signatures may now fail installs that previously succeeded.

Overview
Node installs now verify SHASUMS256.txt GPG signatures for all release lines, not only versions whose string started with 2. The mistaken prefix check meant 18.x/19.x and future 30.x would skip signature validation even though nodejs.org publishes .sig files; releases without a signature still skip via the existing 404 path in verify_with_gpg.

A new e2e test (e2e/core/test_node_gpg_verify) serves a fake 18.20.8 mirror with a mismatched signature and expects install failure; it also confirms MISE_NODE_GPG_VERIFY=false bypasses GPG and fails later on checksum lookup. Security metadata text no longer claims GPG is limited to v20+.

^{Reviewed by Cursor Bugbot for commit 48087ca. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 58 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)
• Review profile: CHILL
• Plan: Advanced
• Run ID: 428a177e-b39c-457a-a8ce-5756883d030b

📥 Commits

Reviewing files that changed from the base of the PR and between 4a98b02 and 48087ca.

📒 Files selected for processing (2)

• e2e/core/test_node_gpg_verify
• src/plugins/core/node.rs

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

[High risk] Expands GPG signature verification to all Node versions.

This PR appears safe to merge.

What we checked:

• Older unsigned releases still install: A 404 response still makes verify_with_gpg warn and return success.
• The global setting still works: Settings copy the global value into node.gpg_verify when Node has no explicit override. The changed condition skips verification when that value is false.

Summary

This PR removes the version-prefix check so Node verifies signed SHASUMS256.txt files for older and future release lines.

• Keeps the existing settings that disable verification and the warning when a signature returns 404.
• Adds an 18.x mirror test that rejects a mismatched signature and checks that disabling GPG reaches the checksum lookup.
• No actionable issues found. Tests were inspected, not run.

_{Reviews (1) · Last reviewed commit: "fix(node): verify GPG signatures for eve..." · Reviewed by Greptile}

[github-actions]

Instruction counts

benchmark	trend	instructions	Δ	wall (min)	Δ
env	▃█▁▆▄	27,617,353 → 27,613,941	-0.01%	19.52 → 19.48ms	-0.20%
hook-env	▁█▄▃▂	29,598,137 → 29,596,547	-0.01%	20.65 → 20.51ms	-0.64%
ls	▃▅▁█▁	31,404,378 → 31,374,607	-0.09%	21.34 → 21.92ms	+2.73%
registry	█▇▃▄▁	39,991,186 → 39,912,405	-0.20%	17.82 → 18.08ms	+1.48%
startup	▆▇▆█▁	10,954,162 → 10,934,383	-0.18%	12.00 → 12.06ms	+0.47%

No instruction-count regression above 1%.

_{Only instruction counts gate. Wall clock is shown for context — on identical hardware it moves 4-20% run to run.}

_{Measured by tak — instruction-counted CLI benchmarks, stored in this repository's git notes.}

_{48087cad3b2b vs 4a98b02f988b · measured on the runner, not pushed to the history.}