{"record":{"id":"825774d3df2aac90","repo":"jdx/mise","slug":"no-trusted-public-keys-available-for-verification","errorCode":null,"errorMessage":"no trusted public keys available for verification","messagePattern":"no trusted public keys available for verification","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/gpg.rs","lineNumber":41,"sourceCode":"}\n\n/// Verify a detached signature entirely in-process (no external `gpg` binary).\n///\n/// `public_keys_asc` is one or more ASCII-armored public key blocks (a trusted keyring bundled\n/// with mise). `open_data` returns a fresh reader over the signed content each time it is called,\n/// so the content can be streamed (and, if necessary, re-read for another candidate key) without\n/// buffering large files in memory.\n///\n/// Verification succeeds if any signature validates against any of the trusted keys or their\n/// subkeys, mirroring `gpg --verify` against an imported keyring.\nfn verify_detached<R, F>(public_keys_asc: &str, signature: &[u8], open_data: F) -> Result<()>\nwhere\n    R: Read,\n    F: Fn() -> Result<R>,\n{\n    let keys = parse_public_keys(public_keys_asc)?;\n    if keys.is_empty() {\n        bail!(\"no trusted public keys available for verification\");\n    }\n    let signatures = parse_signatures(signature)?;\n    if signatures.is_empty() {\n        bail!(\"no signature found to verify\");\n    }\n\n    // Fast path: only try keys whose id/fingerprint matches the signature's issuer, so the signed\n    // content is hashed at most once in the common case.\n    for sig in &signatures {\n        if verify_against_keys(sig, &keys, &open_data, true)? {\n            return Ok(());\n        }\n    }\n    // Fallback: try every trusted key, but only for signatures that carried no usable issuer\n    // hint. A signature that named an issuer we don't trust is genuinely unverifiable, so skip it\n    // rather than re-hashing the (potentially large) content against every key.\n    for sig in signatures.iter().filter(|sig| !has_issuer(&sig.signature)) {\n        if verify_against_keys(sig, &keys, &open_data, false)? {","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/gpg.rs#L23-L59","documentation":"verify_detached in src/gpg.rs validates detached GPG signatures against a set of trusted public keys. Before doing any cryptographic work it parses the armored key material and throws this error if the resulting key list is empty, meaning there are no trusted keys to verify against.","triggerScenarios":"Calling verify_node, verify_swift, or verify_swift_bytes with a public_keys_asc argument whose armored text contains no parseable SignedPublicKey blocks (empty string, whitespace, or only non-key ASCII-armored blocks).","commonSituations":"Misconfigured mise settings where the trusted keyring variable is empty; a truncated or corrupted armor file; passing only a signature file instead of key material; upstream project changed its key distribution so the configured key list resolves to nothing.","solutions":["Ensure the public_keys_asc argument (or mise setting feeding it) contains valid ASCII-armored public key blocks starting with -----BEGIN PGP PUBLIC KEY BLOCK-----","Re-download the trusted keys from the official project keyserver/release repo and point the setting at the correct file","Check for typos or empty values in the relevant settings/env vars (e.g. node.gpg_keys / swift keys config)","If GPG verification is not wanted, disable checksum/signature verification for that backend instead of passing empty keys"],"exampleFix":"// before\nlet keys = \"\"; // or a file with only release notes\nverify_node(&archive, sig, keys)?;\n// after\nlet keys = std::fs::read_to_string(\"node_keys.asc\")?; // contains BEGIN PGP PUBLIC KEY BLOCK\nverify_node(&archive, sig, keys)?;","handlingStrategy":"validation","validationCode":"let keys = std::fs::read_to_string(key_path)?;\nif !keys.contains(\"-----BEGIN PGP PUBLIC KEY BLOCK-----\") {\n    anyhow::bail!(\"key file {} contains no public key blocks\", key_path);\n}\nverify_node(&archive, sig, keys)?;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always point trust settings at real armored key files fetched from official sources","Validate key files non-empty and contain a PGP PUBLIC KEY BLOCK header before use","Pin trusted keys in version control so they cannot silently become empty"],"tags":["gpg","verification","signing"],"backgroundTag":"empty-required-field","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}