Heroku Node.js App Fails with PNPM 'Cannot find matching keyid' Error After Dyno Restart

Below is an explanation of what may be happening and why your Dockerfile change can be considered a legitimate workaround.

What Happened?

• Upstream Changes in Node or Corepack:
  The error indicates that Corepack (which is now bundled with Node) isn’t able to verify the signature it expects when using pnpm. This might be due to an update in the Node base image (in your case, node:20-alpine) that altered Corepack’s behavior or default settings. Such changes can suddenly break previously working builds if strict signature or key verification is enforced.

• Impact on Build Caching and Dependency Management:
  Since your build process relies on caching (via --mount=type=cache) along with package manager tools, any change upstream in the package manager (or its wrapper) can cause these errors. A dyno restart on Heroku may be coincidental or a trigger for pulling the latest image version if you aren’t pinning your base image, thereby exposing you to breaking changes.

Is This a Legitimate Fix?

Yes, the changes you made in your Dockerfile are a common way to regain control over your dependency management:

DOCKERFILECopied
FROM node:20-alpine AS base
ENV PNPM_HOME="/pnpm"
ENV PATH="$PNPM_HOME:$PATH"

# Instead of enabling corepack, disable it and install a specific version of pnpm.
RUN corepack disable && npm install -g pnpm@latest

COPY . /app
WORKDIR /app
# ... (rest of your Dockerfile)

• Disabling Corepack:
  By disabling Corepack, you avoid the unexpected signature verification errors that arise from any internal updates. This gives you control over which package manager version is used.

• Manually Installing pnpm:
  Installing pnpm manually ensures that you’re using the version you need, rather than the one enforced by a potentially changing Corepack configuration.

Considerations Going Forward

• Pinning Your Base Image:
  To avoid surprises from upstream changes, consider pinning your Node base image version rather than using tags like latest or floating versions.

• Monitoring Upstream Changes:
  Keep an eye on Node and Corepack release notes. At some point, a proper fix might be available that lets you safely re-enable Corepack without running into verification issues.

• Evaluate Long-term Trade-offs:
  Disabling Corepack means you’re not leveraging its built-in package manager resolution. If your workflow benefits from that, you may want to revisit this decision in the future once the upstream issue is resolved.

In summary, the sudden breakage is likely an unintended consequence of changes in the Node image’s bundled Corepack behavior. Disabling Corepack and explicitly installing pnpm is an acceptable and practical workaround to restore your build’s stability.