Consider making no the default value for NODEJS_CHECK_SIGNATURES

[jaminthorns]

I appreciate the feature to verify the binaries. It gives peace of mind for the file integrity both in terms of corruption and meddling from bad actors. In fact, I think it would be nice if this was part of asdf's core API.

That said, I don't think it should be the default for this plugin. Of the several asdf plugins I've used, none except this one require me to set an environment variable or run a script to install a version of the program. There are some plugins that compile from source and require dependencies to be installed, but since this plugin downloads binaries, it would make sense for them to just work "out-of-the-box", no flags or manually run pre-install scripts.

Is there any reason why the maintainers of this plugin have decided to make binary verification the default?

[augustobmoura]

For what I understood the problem is the need to do extra work after installation, running the script or setting the ignore variable, now that key importation is automatic in every installation (as of #209), there's any other motivation to default NODEJS_CHECK_SIGNATURES to no?

[jaminthorns]

For what I understood the problem is the need to do extra work after installation, running the script or setting the ignore variable, now that key importation is automatic in every installation (as of #209), there's any other motivation to default NODEJS_CHECK_SIGNATURES to no?

Nope! With that fix, an asdf install nodejs VERSION works out-of-the-box without any environment variables or extra steps. Thanks for replying to this and letting me know, since I hadn't realized the default behavior had been changed.