GNU bug report logs - #22440
25.1.50; package.el fails to install with package-check-signature t

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 22440 in the body.
You can then email your comments to 22440 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Mark Oteiza <mvoteiza <at> udel.edu>
To: bug-gnu-emacs <at> gnu.org
Subject: 25.1.50; package.el fails to install with package-check-signature t
Date: Fri, 22 Jan 2016 19:48:57 -0500

From -Q:

(package-initialize)
(setq package-check-signature t)
M-x package-import-keyring RET /path/to/package-keyring.gpg RET
M-x list-packages RET

Attempt to install a package; in this case, debbugs:

  Unsigned file ‘async-1.6.tar’ at http://elpa.gnu.org/packages/

In GNU Emacs 25.1.50.1 (x86_64-unknown-linux-gnu, X toolkit, cairo version 1.14.6, Xaw scroll bars)
 of 2016-01-22 built on logos
Repository revision: 9b2375008348da99b5ec414cd3ca8c4669a12576
Configured using:
 'configure --prefix=/usr --sysconfdir=/etc --libexecdir=/usr/lib
 --localstatedir=/var --without-gconf --without-imagemagick --with-cairo
 --with-modules --with-x-toolkit=lucid 'CFLAGS=-march=x86-64
 -mtune=generic -O0 -pipe -fstack-protector-strong
 --param=ssp-buffer-size=4 -g -fvar-tracking-assignments -g
 -fvar-tracking-assignments'
 LDFLAGS=-Wl,-O0,--sort-common,--as-needed,-z,relro'

Configured features:
XPM JPEG TIFF GIF PNG RSVG CAIRO SOUND GPM DBUS GSETTINGS NOTIFY ACL
GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB TOOLKIT_SCROLL_BARS
LUCID X11 MODULES

Important settings:
  value of $LC_COLLATE: C
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Message #12 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: Mark Oteiza <mvoteiza <at> udel.edu>
Cc: 22440 <at> debbugs.gnu.org
Subject: Re: 25.1.50; package.el fails to install with package-check-signature
 t
Date: Sun, 15 May 2016 00:03:09 -0700

Sorry, I don't see a bug here <http://bugs.gnu.org/22440>.

package-check-signature t means check package signatures when installing, and do
not install a package if it is unsigned. Which is what is happening, right?

Message #15 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Dmitry Gutov <dgutov <at> yandex.ru>
To: Paul Eggert <eggert <at> cs.ucla.edu>, Mark Oteiza <mvoteiza <at> udel.edu>
Cc: 22440 <at> debbugs.gnu.org
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Sun, 15 May 2016 14:32:44 +0300

On 05/15/2016 10:03 AM, Paul Eggert wrote:

> package-check-signature t means check package signatures when installing, and do
> not install a package if it is unsigned. Which is what is happening, right?

Aren't packages coming from GNU ELPA supposed to all be signed?

Message #18 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: Dmitry Gutov <dgutov <at> yandex.ru>, Mark Oteiza <mvoteiza <at> udel.edu>
Cc: 22440 <at> debbugs.gnu.org, Artur Malabarba <bruce.connor.am <at> gmail.com>
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Sun, 15 May 2016 09:50:29 -0700

Dmitry Gutov wrote:
> On 05/15/2016 10:03 AM, Paul Eggert wrote:
> 
>> package-check-signature t means check package signatures when installing, and do
>> not install a package if it is unsigned. Which is what is happening, right?
> 
> Aren't packages coming from GNU ELPA supposed to all be signed?

Sorry, I don't know. I don't even know how to determine whether that particular
package is signed. I know little about packages and am just trying to get this
blocking bug fixed.

It would be helpful if someone could look into this who knows about packages.
I'll CC: this to Artur, who I hope fills the bill. Artur, could you please look
at Bug#22440, or let us know who we should ask about this? Thanks.

Message #21 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Paul Eggert <eggert <at> cs.ucla.edu>, Dmitry Gutov <dgutov <at> yandex.ru>, 
 Mark Oteiza <mvoteiza <at> udel.edu>
Cc: 22440 <at> debbugs.gnu.org
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Mon, 16 May 2016 10:59:04 +0000

[Message part 1 (text/plain, inline)]

I'll look into it tonight.
Thanks for ccing me.

On Sun, 15 May 2016 1:50 pm Paul Eggert, <eggert <at> cs.ucla.edu> wrote:

> Dmitry Gutov wrote:
> > On 05/15/2016 10:03 AM, Paul Eggert wrote:
> >
> >> package-check-signature t means check package signatures when
> installing, and do
> >> not install a package if it is unsigned. Which is what is happening,
> right?
> >
> > Aren't packages coming from GNU ELPA supposed to all be signed?
>
> Sorry, I don't know. I don't even know how to determine whether that
> particular
> package is signed. I know little about packages and am just trying to get
> this
> blocking bug fixed.
>
> It would be helpful if someone could look into this who knows about
> packages.
> I'll CC: this to Artur, who I hope fills the bill. Artur, could you please
> look
> at Bug#22440, or let us know who we should ask about this? Thanks.
>

[Message part 2 (text/html, inline)]

Message #24 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Paul Eggert <eggert <at> cs.ucla.edu>, Dmitry Gutov <dgutov <at> yandex.ru>, 
 Mark Oteiza <mvoteiza <at> udel.edu>
Cc: 22440 <at> debbugs.gnu.org
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Wed, 18 May 2016 13:50:25 +0000

[Message part 1 (text/plain, inline)]

I couldn't reproduce this, so it might have been fixed already.
Mark, could you check if this has been fixed for you?

Also, I believe the import-keyring step is unnecessary. Emacs already uses
the package-keyring file that ships with it.

[Message part 2 (text/html, inline)]

Message #27 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Mark Oteiza <mvoteiza <at> udel.edu>
To: Artur Malabarba <bruce.connor.am <at> gmail.com>
Cc: 22440 <at> debbugs.gnu.org, Paul Eggert <eggert <at> cs.ucla.edu>,
 Dmitry Gutov <dgutov <at> yandex.ru>
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Wed, 18 May 2016 12:29:35 -0400

On 18/05/16 at 01:50pm, Artur Malabarba wrote:
> I couldn't reproduce this, so it might have been fixed already.
> Mark, could you check if this has been fixed for you?

It appears to have been fixed. No idea what fixed it.

Message #30 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Dmitry Gutov <dgutov <at> yandex.ru>
To: Artur Malabarba <bruce.connor.am <at> gmail.com>,
 Paul Eggert <eggert <at> cs.ucla.edu>, Mark Oteiza <mvoteiza <at> udel.edu>
Cc: 22440 <at> debbugs.gnu.org
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Wed, 18 May 2016 19:36:24 +0300

On 05/18/2016 04:50 PM, Artur Malabarba wrote:
> I couldn't reproduce this, so it might have been fixed already.
> Mark, could you check if this has been fixed for you?

I've just tried (setq package-check-signature t), and then installing 
async 1.6, and the problem was there.

Not the most recent Emacs, though (revision 1a5a05c).

Message #33 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Mark Oteiza <mvoteiza <at> udel.edu>
To: Dmitry Gutov <dgutov <at> yandex.ru>
Cc: 22440 <at> debbugs.gnu.org, Paul Eggert <eggert <at> cs.ucla.edu>,
 Artur Malabarba <bruce.connor.am <at> gmail.com>
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Wed, 18 May 2016 12:44:05 -0400

On 18/05/16 at 07:36pm, Dmitry Gutov wrote:
> On 05/18/2016 04:50 PM, Artur Malabarba wrote:
> > I couldn't reproduce this, so it might have been fixed already.
> > Mark, could you check if this has been fixed for you?
> 
> I've just tried (setq package-check-signature t), and then installing async
> 1.6, and the problem was there.
> 
> Not the most recent Emacs, though (revision 1a5a05c).

Mine is a little older, and I must retract my previous email. Apparently
after doing M-x list-packages, package-check-signature is
allow-unsigned again, not t.  I have to (setq package-check-signature t)
after list-packages now.

The issue persists. FWIW my version is 2eb6817

Message #36 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: Mark Oteiza <mvoteiza <at> udel.edu>, Dmitry Gutov <dgutov <at> yandex.ru>
Cc: 22440 <at> debbugs.gnu.org, Artur Malabarba <bruce.connor.am <at> gmail.com>
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Wed, 18 May 2016 11:10:14 -0700

On 05/18/2016 09:44 AM, Mark Oteiza wrote:
> Apparently
> after doing M-x list-packages, package-check-signature is
> allow-unsigned again, not t.

I observed the same thing, but as I have no idea how packages ought to 
work I didn't know whether that was expected. If not, it's a bug too -- 
should it get a different bug report or is this all the same bug?

Message #39 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Dmitry Gutov <dgutov <at> yandex.ru>
To: Paul Eggert <eggert <at> cs.ucla.edu>, Mark Oteiza <mvoteiza <at> udel.edu>
Cc: 22440 <at> debbugs.gnu.org, Artur Malabarba <bruce.connor.am <at> gmail.com>
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Wed, 18 May 2016 21:23:13 +0300

On 05/18/2016 09:10 PM, Paul Eggert wrote:

> I observed the same thing, but as I have no idea how packages ought to
> work I didn't know whether that was expected. If not, it's a bug too --
> should it get a different bug report or is this all the same bug?

These are related, but orthogonal issues.

The newfound bug is that package-refresh-contents for some reason 
expects that package-check-signature could have only been modified via 
Custom.

Message #42 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: Mark Oteiza <mvoteiza <at> udel.edu>, ueno <at> gnu.org, 22440 <at> debbugs.gnu.org,
 Dmitry Gutov <dgutov <at> yandex.ru>
Subject: Re: bug#22440: 25.1.50;
 package.el fails to install with package-check-signature t
Date: Wed, 18 May 2016 16:24:17 -0300

Paul Eggert <eggert <at> cs.ucla.edu> writes:

> I observed the same thing, but as I have no idea how packages ought to work I didn't know whether that was expected. If not, it's a bug too -- 
> should it get a different bug report or is this all the same bug?

Yes, it's a bug. Looks like it was introduced by the commit below.
I've CC'd Daiki.

14aec913ac3f0dd408487c0e8327403e0f239964
Author:     Daiki Ueno <ueno <at> gnu.org>
AuthorDate: Wed Feb 17 16:44:16 2016 +0900

Take advantage of new GnuPG version check function

* lisp/emacs-lisp/package.el (epg-configuration-find): Declare.
(package-refresh-contents): Use `epg-configuration-find' to check if EPG
is usable.

1 file changed, 9 insertions(+), 6 deletions(-)
lisp/emacs-lisp/package.el | 15 +++++++++------

modified   lisp/emacs-lisp/package.el
@@ -1452,9 +1452,8 @@ package-initialize
 (defvar package--downloads-in-progress nil
   "List of in-progress asynchronous downloads.")
 
-(declare-function epg-check-configuration "epg-config"
-                  (config &optional minimum-version))
-(declare-function epg-configuration "epg-config" ())
+(declare-function epg-configuration-find "epg-config"
+                  (protocol &optional force))
 (declare-function epg-import-keys-from-file "epg" (context keys))
 
 ;;;###autoload
@@ -1554,11 +1553,15 @@ package-refresh-contents
   (let ((default-keyring (expand-file-name "package-keyring.gpg"
                                            data-directory))
         (inhibit-message async))
+    (if (get 'package-check-signature 'saved-value)
+        (when package-check-signature
+          (epg-configuration-find 'OpenPGP))
+      (setq package-check-signature
+            (if (epg-configuration-find 'OpenPGP)
+                'allow-unsigned)))
     (when (and package-check-signature (file-exists-p default-keyring))
       (condition-case-unless-debug error
-          (progn
-            (epg-check-configuration (epg-configuration))
-            (package-import-keyring default-keyring))
+          (package-import-keyring default-keyring)
         (error (message "Cannot import default keyring: %S" (cdr error))))))
   (package--download-and-read-archives async))

Message #45 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: Mark Oteiza <mvoteiza <at> udel.edu>, ueno <at> gnu.org, 22440 <at> debbugs.gnu.org,
 Dmitry Gutov <dgutov <at> yandex.ru>
Subject: Re: bug#22440: 25.1.50;
 package.el fails to install with package-check-signature t
Date: Wed, 18 May 2016 16:33:04 -0300

Artur Malabarba <bruce.connor.am <at> gmail.com> writes:

> Paul Eggert <eggert <at> cs.ucla.edu> writes:
>
>> I observed the same thing, but as I have no idea how packages ought to work I didn't know whether that was expected. If not, it's a bug too -- 
>> should it get a different bug report or is this all the same bug?
>
> Yes, it's a bug. Looks like it was introduced by the commit below.
> I've CC'd Daiki.

Here's a proposed fix.

---

Author:     Artur Malabarba <bruce.connor.am <at> gmail.com>

* lisp/emacs-lisp/package.el (package-refresh-contents):

Don't change the value of `package-check-signature'.
(package-check-signature): Use `epg-find-configuration'
instead of `executable-find'.

1 file changed, 6 insertions(+), 10 deletions(-)
lisp/emacs-lisp/package.el | 16 ++++++----------

modified   lisp/emacs-lisp/package.el
@@ -302,10 +302,12 @@ package-directory-list
   :risky t
   :version "24.1")
 
-(defvar epg-gpg-program)
+(declare-function epg-find-configuration "epg-config"
+                  (protocol &optional force))
 
 (defcustom package-check-signature
-  (if (progn (require 'epg-config) (executable-find epg-gpg-program))
+  (if (and (require 'epg-config)
+           (epg-find-configuration 'OpenPGP))
       'allow-unsigned)
   "Non-nil means to check package signatures when installing.
 The value `allow-unsigned' means to still install a package even if
@@ -1457,8 +1459,6 @@ package-initialize
 (defvar package--downloads-in-progress nil
   "List of in-progress asynchronous downloads.")
 
-(declare-function epg-find-configuration "epg-config"
-                  (protocol &optional force))
 (declare-function epg-import-keys-from-file "epg" (context keys))
 
 ;;;###autoload
@@ -1558,12 +1558,8 @@ package-refresh-contents
   (let ((default-keyring (expand-file-name "package-keyring.gpg"
                                            data-directory))
         (inhibit-message async))
-    (if (get 'package-check-signature 'saved-value)
-        (when package-check-signature
-          (epg-find-configuration 'OpenPGP))
-      (setq package-check-signature
-            (if (epg-find-configuration 'OpenPGP)
-                'allow-unsigned)))
+    (when package-check-signature
+      (epg-find-configuration 'OpenPGP))
     (when (and package-check-signature (file-exists-p default-keyring))
       (condition-case-unless-debug error
           (package-import-keyring default-keyring)

Message #48 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: Mark Oteiza <mvoteiza <at> udel.edu>, 22440 <at> debbugs.gnu.org,
 Dmitry Gutov <dgutov <at> yandex.ru>
Subject: Re: bug#22440: 25.1.50;
 package.el fails to install with package-check-signature t
Date: Wed, 18 May 2016 16:43:44 -0300

Artur Malabarba <bruce.connor.am <at> gmail.com> writes:

> I couldn't reproduce this, so it might have been fixed already.
> Mark, could you check if this has been fixed for you?

Given the other information provided on this thread, I can indeed
reproduce this now. I'll look into it.

Message #51 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: Mark Oteiza <mvoteiza <at> udel.edu>, 22440 <at> debbugs.gnu.org,
 Dmitry Gutov <dgutov <at> yandex.ru>
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Wed, 18 May 2016 20:43:58 +0000

[Message part 1 (text/plain, inline)]

How do we run tests for a single file with the new test structure? I use to
call `make package-test` inside the test/automated directory. But I can't
seem to find an equivalent with the new structure.

On Wed, May 18, 2016 at 4:43 PM Artur Malabarba <bruce.connor.am <at> gmail.com>
wrote:

> Artur Malabarba <bruce.connor.am <at> gmail.com> writes:
>
> > I couldn't reproduce this, so it might have been fixed already.
> > Mark, could you check if this has been fixed for you?
>
> Given the other information provided on this thread, I can indeed
> reproduce this now. I'll look into it.
>

[Message part 2 (text/html, inline)]

Message #54 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: Mark Oteiza <mvoteiza <at> udel.edu>, 22440 <at> debbugs.gnu.org,
 Dmitry Gutov <dgutov <at> yandex.ru>
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Wed, 18 May 2016 21:09:30 +0000

[Message part 1 (text/plain, inline)]

Should now be fixed on the emacs-25 branch. Please test if it works for you
as well.

On Wed, May 18, 2016 at 5:43 PM Artur Malabarba <bruce.connor.am <at> gmail.com>
wrote:

> How do we run tests for a single file with the new test structure? I use
> to call `make package-test` inside the test/automated directory. But I
> can't seem to find an equivalent with the new structure.
>
> On Wed, May 18, 2016 at 4:43 PM Artur Malabarba <bruce.connor.am <at> gmail.com>
> wrote:
>
>> Artur Malabarba <bruce.connor.am <at> gmail.com> writes:
>>
>> > I couldn't reproduce this, so it might have been fixed already.
>> > Mark, could you check if this has been fixed for you?
>>
>> Given the other information provided on this thread, I can indeed
>> reproduce this now. I'll look into it.
>>
>

[Message part 2 (text/html, inline)]

Message #57 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: Artur Malabarba <bruce.connor.am <at> gmail.com>
Cc: Mark Oteiza <mvoteiza <at> udel.edu>, 22440 <at> debbugs.gnu.org,
 Dmitry Gutov <dgutov <at> yandex.ru>
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Wed, 18 May 2016 15:05:15 -0700

On 05/18/2016 02:09 PM, Artur Malabarba wrote:
> Should now be fixed on the emacs-25 branch. Please test if it works 
> for you as well.

When I build emacs-25 now, it issues new warnings like the following. 
What are these warnings symptoms of, and can the problem be avoided?


  ELC      emacs-lisp/package.elc

In package--check-signature:
emacs-lisp/package.el:1248:36:Warning: reference to free variable ‘url’
emacs-lisp/package.el:1248:36:Warning: reference to free variable ‘b-sym’

In package--download-one-archive:
emacs-lisp/package.el:1508:39:Warning: reference to free variable ‘url’
emacs-lisp/package.el:1508:39:Warning: reference to free variable ‘b-sym’

In package-install-from-archive:
emacs-lisp/package.el:1806:36:Warning: reference to free variable ‘url’
emacs-lisp/package.el:1806:36:Warning: reference to free variable ‘b-sym’

In describe-package-1:
emacs-lisp/package.el:2403:53:Warning: reference to free variable ‘url’
emacs-lisp/package.el:2403:53:Warning: reference to free variable ‘b-sym’

Message #60 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: Mark Oteiza <mvoteiza <at> udel.edu>, 22440 <at> debbugs.gnu.org,
 Dmitry Gutov <dgutov <at> yandex.ru>
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Wed, 18 May 2016 23:11:50 +0000

[Message part 1 (text/plain, inline)]

Just an unfortunate consequence of how macroexpand-let works. I've now
fixed them by changing those 2 symbols to a plain let.

On Wed, May 18, 2016 at 7:05 PM Paul Eggert <eggert <at> cs.ucla.edu> wrote:

> On 05/18/2016 02:09 PM, Artur Malabarba wrote:
> > Should now be fixed on the emacs-25 branch. Please test if it works
> > for you as well.
>
> When I build emacs-25 now, it issues new warnings like the following.
> What are these warnings symptoms of, and can the problem be avoided?
>
>
>    ELC      emacs-lisp/package.elc
>
> In package--check-signature:
> emacs-lisp/package.el:1248:36:Warning: reference to free variable ‘url’
> emacs-lisp/package.el:1248:36:Warning: reference to free variable ‘b-sym’
>
> In package--download-one-archive:
> emacs-lisp/package.el:1508:39:Warning: reference to free variable ‘url’
> emacs-lisp/package.el:1508:39:Warning: reference to free variable ‘b-sym’
>
> In package-install-from-archive:
> emacs-lisp/package.el:1806:36:Warning: reference to free variable ‘url’
> emacs-lisp/package.el:1806:36:Warning: reference to free variable ‘b-sym’
>
> In describe-package-1:
> emacs-lisp/package.el:2403:53:Warning: reference to free variable ‘url’
> emacs-lisp/package.el:2403:53:Warning: reference to free variable ‘b-sym’
>
>

[Message part 2 (text/html, inline)]

Message #63 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Daiki Ueno <ueno <at> gnu.org>
To: Artur Malabarba <bruce.connor.am <at> gmail.com>
Cc: Mark Oteiza <mvoteiza <at> udel.edu>, Paul Eggert <eggert <at> cs.ucla.edu>,
 22440 <at> debbugs.gnu.org, Dmitry Gutov <dgutov <at> yandex.ru>
Subject: Re: bug#22440: 25.1.50;
 package.el fails to install with package-check-signature t
Date: Thu, 19 May 2016 10:30:08 +0900

Artur Malabarba <bruce.connor.am <at> gmail.com> writes:

> Here's a proposed fix.

Thank you for taking a look at this, the patch looks good to me.

>  ;;;###autoload
> @@ -1558,12 +1558,8 @@ package-refresh-contents
>    (let ((default-keyring (expand-file-name "package-keyring.gpg"
>                                             data-directory))
>          (inhibit-message async))
> -    (if (get 'package-check-signature 'saved-value)
> -        (when package-check-signature
> -          (epg-find-configuration 'OpenPGP))
> -      (setq package-check-signature
> -            (if (epg-find-configuration 'OpenPGP)
> -                'allow-unsigned)))
> +    (when package-check-signature
> +      (epg-find-configuration 'OpenPGP))

While it was from the original code, I would suggest to check the return
value of `epg-find-configuration' or simply remove this `when' clause.

Regards,
-- 
Daiki Ueno

Message #66 received at 22440 <at> debbugs.gnu.org (full text, mbox):

From: Lizzie Dixon <_ <at> lizzie.io>
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: Mark Oteiza <mvoteiza <at> udel.edu>, 22440 <at> debbugs.gnu.org,
 Artur Malabarba <bruce.connor.am <at> gmail.com>, Dmitry Gutov <dgutov <at> yandex.ru>
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Wed, 18 May 2016 21:39:05 -0700

On 05/15, Paul Eggert wrote:
> Dmitry Gutov wrote:
> > On 05/15/2016 10:03 AM, Paul Eggert wrote:
> > 
> >> package-check-signature t means check package signatures when installing, and do
> >> not install a package if it is unsigned. Which is what is happening, right?
> > 
> > Aren't packages coming from GNU ELPA supposed to all be signed?
> 
> Sorry, I don't know. I don't even know how to determine whether that particular
> package is signed.

You can tell because http://elpa.gnu.org/packages/async-1.9.tar.sig exists.

$ curl -O 'http://elpa.gnu.org/packages/async-1.9.tar'
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 61440  100 61440    0     0  98420      0 --:--:-- --:--:-- --:--:-- 98304
$ curl -O 'http://elpa.gnu.org/packages/async-1.9.tar.sig'
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    96  100    96    0     0    254      0 --:--:-- --:--:-- --:--:--   253
$ gpg --no-default-keyring --keyring /usr/share/emacs/25.0.93/etc/package-keyring.gpg --verify async-1.9.tar.sig 
gpg: assuming signed data in 'async-1.9.tar'
gpg: Signature made Wed 18 May 2016 02:05:02 PM PDT using DSA key ID 7FBDEF9B
gpg: Good signature from "GNU ELPA Signing Agent <elpasign <at> elpa.gnu.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: CA44 2C00 F917 74F1 7F59  D9B0 474F 0583 7FBD EF9B

Message #71 received at 22440-done <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: Artur Malabarba <bruce.connor.am <at> gmail.com>
Cc: Mark Oteiza <mvoteiza <at> udel.edu>, 22440-done <at> debbugs.gnu.org,
 Dmitry Gutov <dgutov <at> yandex.ru>
Subject: Re: bug#22440: 25.1.50; package.el fails to install with
 package-check-signature t
Date: Thu, 19 May 2016 08:15:56 -0700

On 05/18/2016 04:11 PM, Artur Malabarba wrote:
> Just an unfortunate consequence of how macroexpand-let works. I've now 
> fixed them by changing those 2 symbols to a plain let.

Thanks for doing all that and for fixing the bug. Closing the bug report.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.