Skip to content

GPG signature verification issue with install-cli-action@4 #46

Description

@redbassett

I have dependabot trying to upgrade 1password/install-cli-action@v4 from v3 and this change is breaking my builds. I see a few other recent issues on here that are closed referencing breaking of builds (#38, #42, and #43 in particular), however none of these seem to indicate the same issue I am seeing:

2026-07-17T06:22:45.0353924Z ##[group]Run 1password/install-cli-action@v4
2026-07-17T06:22:45.0354443Z with:
2026-07-17T06:22:45.0354820Z   version: latest
2026-07-17T06:22:45.0355215Z ##[endgroup]
2026-07-17T06:22:45.0359812Z ##[command]/usr/bin/docker exec  59519c4b1080fa70b621f5ce218d63eb00f1e193449a0182021344a370a5262e sh -c "cat /etc/*release | grep ^ID"
2026-07-17T06:22:45.2868301Z Validating version number: 'latest'
2026-07-17T06:22:45.2873788Z Version number 'latest' is valid
2026-07-17T06:22:45.2883307Z Resolving version: latest
2026-07-17T06:22:45.2884194Z Getting latest version number
2026-07-17T06:22:45.6904623Z Downloading 1Password CLI from: https://cache.agilebits.com/dist/1P/op2/pkg/v2.35.0/op_linux_amd64_v2.35.0.zip
2026-07-17T06:22:46.0325340Z Installing 1Password CLI
2026-07-17T06:22:46.0372334Z [command]/usr/bin/unzip -o -q /__w/_temp/ce470b24-5220-48e6-ab94-7b1feed400a3
2026-07-17T06:22:46.4479642Z Verifying 1Password CLI signature
2026-07-17T06:22:46.4609802Z error: Error: 1Password CLI signature verification failed: spawn gpg ENOENT. If 1Password has rotated their GPG signing key, this action needs to be updated — please file an issue at https://github.com/1Password/install-cli-action/issues.
2026-07-17T06:22:46.4615382Z     at verifyLinuxSignature (file:///__w/_actions/1password/install-cli-action/v4/dist/index.js:34580:15)
2026-07-17T06:22:46.4616750Z     at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
2026-07-17T06:22:46.4618136Z     at async LinuxInstaller.install (file:///__w/_actions/1password/install-cli-action/v4/dist/index.js:34609:9)
2026-07-17T06:22:46.4619840Z     at async LinuxInstaller.installCli (file:///__w/_actions/1password/install-cli-action/v4/dist/index.js:34600:9)
2026-07-17T06:22:46.4621188Z     at async installCliOnGithubActionRunner (file:///__w/_actions/1password/install-cli-action/v4/dist/index.js:34828:5)
2026-07-17T06:22:46.4622680Z     at async run (file:///__w/_actions/1password/install-cli-action/v4/dist/index.js:34843:9)
2026-07-17T06:22:46.4651021Z ##[error]1Password CLI signature verification failed: spawn gpg ENOENT. If 1Password has rotated their GPG signing key, this action needs to be updated — please file an issue at https://github.com/1Password/install-cli-action/issues.

As noted in the above logs, there seems to be a signature issue occurring with simply the change of the the version tag from v3 to v4 on an otherwise-working build workflow.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions