bug#22089: installs packages with bad signatures

bug#22089: installs packages with bad signatures

[Glenn Morris]

Package: emacs
Version: 25.0.50
Severity: important

Emacs happily installs packages with bad gpg signatures.
This has been flagged by the test-suite and automated builds for the past
several weeks. (I feel like asking why we even have those things, for
all the attention they seem to get.)

This seems to be the first failure.
http://hydra.nixos.org/build/27800227

Here is the diff from the previous build, with several package changes:
http://hydra.nixos.org/api/scmdiff?type=git&rev2=937565268a5dc3377d4c9bff6d48eb3645a77160&rev1=70f1fda4ae6abb5e11dcf281738c25f6f5b06061&uri=git%3A%2F%2Fgit.sv.gnu.org%2Femacs.git&branch=

Here's a standalone recipe in the emacs-25 branch:

cd test/automated
mkdir /tmp/foo
HOME=/tmp/foo ../../src/emacs -Q
(setq package-archives `(("gnu" . ,(expand-file-name "data/package/signed/"))))
(package-import-keyring "data/package/key.pub")
(package-initialize)
(package-refresh-contents)
(package-install 'signed-bad)

M-x list-packages    ->  signed-bad installed

bug#22089: installs packages with bad signatures

[Artur Malabarba]

[-- Attachment #1: Type: text/plain, Size: 68 bytes --]

Thanks for the pointer, Glenn. I clearly messed something up there.

[-- Attachment #2: Type: text/html, Size: 86 bytes --]

bug#22089: installs packages with bad signatures

[Michael Albinus]

Glenn Morris <rgm@gnu.org> writes:

> Emacs happily installs packages with bad gpg signatures.
> This has been flagged by the test-suite and automated builds for the past
> several weeks. (I feel like asking why we even have those things, for
> all the attention they seem to get.)

Off-topic to this bug, but: hydra status mails to <emacs-buildstatus@gnu.org>
have been stopped three months ago. Maybe this could be reactivated;
people (like me) check this list.

Best regards, Michael.

bug#22089: installs packages with bad signatures

[Glenn Morris]

Michael Albinus wrote:

> Off-topic to this bug, but: hydra status mails to <emacs-buildstatus@gnu.org>
> have been stopped three months ago. Maybe this could be reactivated;
> people (like me) check this list.

The place to ask about such things is the hydra-users mailing list.
I've asked about this specific issue several times.
The latest times I asked, I got no reply.
Perhaps they are tired of talking to me (so you could ask instead),
but I assume that for some reason the mail notification feature can't
be fixed and isn't coming back. It's a shame, but personally I just
check the web status page now and then instead.

But if hacking on foo.el, run foo-tests.el (at least) before pushing.
It's not rocket science.
Eg today I see that simple-test is trivially broken by recent changes
in simple.el.

bug#22089: installs packages with bad signatures

[Artur Malabarba]

2015-12-04 18:42 GMT+00:00 Glenn Morris <rgm@gnu.org>:
> But if hacking on foo.el, run foo-tests.el (at least) before pushing.
> It's not rocket science.
> Eg today I see that simple-test is trivially broken by recent changes
> in simple.el.


FWIW, I always run the relevant tests before pushing. For some reason,
that specific test is always skipped on my system if I run it with
`make'. That's why I didn't catch that.

bug#22089: installs packages with bad signatures

[Artur Malabarba]

I push a fix for this today. Now waiting for the hydra build to run.
Is this the correct place to look? http://hydra.nixos.org/build/28513720

2015-12-05 11:35 GMT+00:00 Artur Malabarba <bruce.connor.am@gmail.com>:
> 2015-12-04 18:42 GMT+00:00 Glenn Morris <rgm@gnu.org>:
>> But if hacking on foo.el, run foo-tests.el (at least) before pushing.
>> It's not rocket science.
>> Eg today I see that simple-test is trivially broken by recent changes
>> in simple.el.
>
>
> FWIW, I always run the relevant tests before pushing. For some reason,
> that specific test is always skipped on my system if I run it with
> `make'. That's why I didn't catch that.

bug#22089: installs packages with bad signatures

[Michael Albinus]

Artur Malabarba <bruce.connor.am@gmail.com> writes:

> I push a fix for this today. Now waiting for the hydra build to run.
> Is this the correct place to look? http://hydra.nixos.org/build/28513720

Not really. Start at <http://hydra.nixos.org/jobset/gnu/emacs-25>. There
you see, that there is still one failing test.

Follow <red 1> -> coverage -> Logfile: raw

At the end of the file, you see that package-test.log does not fail any
longer. If you perform the same exercise with a previous test run,
package-test.log was still mentioned to fail.

Best regards, Michael.

bug#22089: installs packages with bad signatures

[Artur Malabarba]

[-- Attachment #1: Type: text/plain, Size: 39 bytes --]

Ok, thanks Michael.
Closing this then.

[-- Attachment #2: Type: text/html, Size: 63 bytes --]