If you get "aws: [ERROR]: gpg was not found" with the aws update command, install gpg

Hello, this is Usuda.

Is everyone using the AWS CLI? (That's my greeting)

This time, as the title suggests, this is about how to handle an error that occurs when using the update command in the AWS CLI.

Conclusion

If you get the [ERROR]: gpg was not found error when running the aws update command, install gpg (GnuPG)!

The symptom looks like this.

aws update
Updating AWS CLI (source: script-exe)
Downloading https://awscli.amazonaws.com/v2/install.sh

aws: [ERROR]: gpg was not found, so the downloaded install script cannot be verified. Install gnupg and try again, re-run with --skip-signature-verification, or set AWS_CLI_INSTALL_SKIP_SIGNATURE_VERIFICATION=true, to update without verification (not recommended).

On macOS, you can install GnuPG via brew as follows.

% brew install gnupg
…omitted…
==> Installing gnupg
==> Pouring gnupg--2.5.24_1.arm64_sequoia.bottle.tar.gz
No matching processes belonging to you were found
🍺  /opt/homebrew/Cellar/gnupg/2.5.24_1: 149 files, 16MB

For installation on other operating systems, please look up the method for each one.

After completing the GnuPG installation, run aws update again and it will complete successfully.

% aws update
Updating AWS CLI (source: script-exe)
Downloading https://awscli.amazonaws.com/v2/install.sh
Downloading https://awscli.amazonaws.com/v2/install.sh.sig
Install script signature verified. # Signature verification completed
Running install script...
…rest omitted…

Explanation

The aws update command was recently implemented in the AWS CLI, making it easy to update from version 2.36.0 onwards.

https://dev.classmethod.jp/articles/aws-cli-aws-update-command/

Previously, with the official procedure, if you had installed via a curl-fetched script-based execution or by downloading and installing a package, you needed to update using the same type of method.

Install a previously released version of AWS CLI version 2 - AWS Command Line Interface

If you were using a package manager like Homebrew, updating was relatively easy, but that is currently not officially supported.

So, when I finally got to try updating the version easily, I got the following result.

aws update
Updating AWS CLI (source: script-exe)
Downloading https://awscli.amazonaws.com/v2/install.sh

aws: [ERROR]: gpg was not found, so the downloaded install script cannot be verified. Install gnupg and try again, re-run with --skip-signature-verification, or set AWS_CLI_INSTALL_SKIP_SIGNATURE_VERIFICATION=true, to update without verification (not recommended).

The error says "the gpg command is not found, so the install script cannot be verified."

Two options are presented.

1. Install GnuPG
2. [Not recommended] Re-run with the --skip-signature-verification option or set the AWS_CLI_INSTALL_SKIP_SIGNATURE_VERIFICATION=true environment variable. Signature verification will not be performed.

GnuPG is used to encrypt/decrypt data, create digital signatures, and verify them. Even in the past installation instructions for AWS CLI, there was an optional step for manually verifying the signature.

With the new aws update command, the signature verification process has been incorporated and is now performed automatically.

Even if you adopt the --skip-signature-verification option approach, you will always need the same steps going forward, and above all it is a non-recommended procedure, so both from a security standpoint and in terms of the simplicity of updating that is the essence of this feature, installing GnuPG is the only choice.

So, let's install GnuPG.

On macOS, you can install it with Homebrew as follows.

% brew install gnupg
…omitted…
==> Installing gnupg
==> Pouring gnupg--2.5.24_1.arm64_sequoia.bottle.tar.gz
No matching processes belonging to you were found
🍺  /opt/homebrew/Cellar/gnupg/2.5.24_1: 149 files, 16MB

Then running it again will succeed. Well, in this case I had just manually upgraded from a version not supported by aws update, so there was no update available.

% aws update
Updating AWS CLI (source: script-exe)
Downloading https://awscli.amazonaws.com/v2/install.sh
Downloading https://awscli.amazonaws.com/v2/install.sh.sig
Install script signature verified.
Running install script...
Resolving user-local install paths:
  HOME=/Users/hoge
  XDG_DATA_HOME=/Users/hoge/.local/share
  XDG_BIN_HOME=/Users/hoge/.local/bin
AWS CLI 2.38.5 is already installed at /Users/hoge/.local/share/aws-cli; nothing to do.

Summary

The aws update command is undoubtedly a lifesaver!

Install GnuPG and use it comfortably!