From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Stefan Monnier Newsgroups: gmane.emacs.bugs Subject: bug#35414: 26.2; ELPA packages signed with second, unknown key Date: Wed, 24 Apr 2019 15:36:50 -0400 Message-ID: References: <87mukfsgtb.fsf@invergo.net> Mime-Version: 1.0 Content-Type: text/plain Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="187216"; mail-complaints-to="usenet@blaine.gmane.org" User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux) Cc: 35414@debbugs.gnu.org, Brandon Invergo To: Glenn Morris Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Wed Apr 24 21:37:23 2019 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([209.51.188.17]) by blaine.gmane.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hJNhq-000mYu-Sy for geb-bug-gnu-emacs@m.gmane.org; Wed, 24 Apr 2019 21:37:23 +0200 Original-Received: from localhost ([127.0.0.1]:46278 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hJNhp-0003CW-Qn for geb-bug-gnu-emacs@m.gmane.org; Wed, 24 Apr 2019 15:37:21 -0400 Original-Received: from eggs.gnu.org ([209.51.188.92]:55797) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hJNhg-0003CE-Qt for bug-gnu-emacs@gnu.org; Wed, 24 Apr 2019 15:37:14 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hJNhZ-0002Kw-5W for bug-gnu-emacs@gnu.org; Wed, 24 Apr 2019 15:37:09 -0400 Original-Received: from debbugs.gnu.org ([209.51.188.43]:42999) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hJNhW-0002KB-Uh for bug-gnu-emacs@gnu.org; Wed, 24 Apr 2019 15:37:03 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1hJNhW-00071g-Q4 for bug-gnu-emacs@gnu.org; Wed, 24 Apr 2019 15:37:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Stefan Monnier Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Wed, 24 Apr 2019 19:37:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 35414 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: security Original-Received: via spool by 35414-submit@debbugs.gnu.org id=B35414.155613461426995 (code B ref 35414); Wed, 24 Apr 2019 19:37:02 +0000 Original-Received: (at 35414) by debbugs.gnu.org; 24 Apr 2019 19:36:54 +0000 Original-Received: from localhost ([127.0.0.1]:56543 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJNhO-00071K-5e for submit@debbugs.gnu.org; Wed, 24 Apr 2019 15:36:54 -0400 Original-Received: from chene.dit.umontreal.ca ([132.204.246.20]:58195) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJNhL-00071C-Ty for 35414@debbugs.gnu.org; Wed, 24 Apr 2019 15:36:53 -0400 Original-Received: from pastel.home (lechon.iro.umontreal.ca [132.204.27.242]) by chene.dit.umontreal.ca (8.14.7/8.14.1) with ESMTP id x3OJaoQu008006; Wed, 24 Apr 2019 15:36:50 -0400 Original-Received: by pastel.home (Postfix, from userid 20848) id 1A3D36AE07; Wed, 24 Apr 2019 15:36:50 -0400 (EDT) In-Reply-To: (Glenn Morris's message of "Wed, 24 Apr 2019 12:08:48 -0400") X-NAI-Spam-Flag: NO X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0.1 X-NAI-Spam-Rules: 3 Rules triggered TRK_NCM1=0.1, EDT_SA_DN_PASS=0, RV6532=0 X-NAI-Spam-Version: 2.3.0.9418 : core <6532> : inlines <7059> : streams <1819617> : uri <2836612> X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.51.188.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.org gmane.emacs.bugs:158199 Archived-At: > I assume (without checking) that this is related to the key from > http://lists.gnu.org/r/emacs-diffs/2019-04/msg00546.html Hmm... Indeed: this new keyring contains two keys (the old 2014 key which will expire in September and a new key to replace it). >> When I execute package-refresh-contents or when I try to install a >> package from ELPA, it fails with the following error: >> >> Failed to verify signature archive-contents.sig: >> No public key for 066DAFCB81E42C40 created at 2019-04-24T10:15:06+0100 using RSA >> Good signature from 474F05837FBDEF9B GNU ELPA Signing Agent (trust undefined) created at 2019-04-24T10:15:06+0100 using DSA >> Command output: >> gpg: Signature made Wed 24 Apr 2019 10:15:06 AM BST >> gpg: using DSA key CA442C00F91774F17F59D9B0474F05837FBDEF9B >> gpg: Good signature from "GNU ELPA Signing Agent " [unknown] >> gpg: WARNING: This key is not certified with a trusted signature! >> gpg: There is no indication that the signature belongs to the owner. >> Primary key fingerprint: CA44 2C00 F917 74F1 7F59 D9B0 474F 0583 7FBD EF9B >> gpg: Signature made Wed 24 Apr 2019 10:15:06 AM BST >> gpg: using RSA key C433554766D3DDC64221BFAA066DAFCB81E42C40 >> gpg: Can't check signature: No public key Hmm... I just tried with Debian's Emacs-25.1 and with a new build from the `emacs-26` branch: emacs -Q --eval '(setq package-check-signature t) M-x package-list-packages RET M-x package-refresh-contents RET and didn't get any error. >> So, the signature by GNU ELPA Signing Agent (the key in >> etc/package-keyring.gpg) is fine. However, there is a second key >> involved, for which the public key 066DAFCB81E42C40 is unavailable from >> any public keyserver that I have tried. It's a brand new key that is now in etc/package-keyring.gpg in the `master` branch of Emacs, as well as in the `gnu-elpa-keyring-update` package in GNU ELPA. This is because the key 474F05837FBDEF9B is about to expire (it's really high time we start preparing for the new key). >> Needless to say, it's not available in etc/package-keyring.gpg >> either. Since I do not have the public key, the signature >> verification fails. Yes, it's normal that the second signature can't be verified until you install the new key, but that shouldn't cause an error in package-install or package-refresh-contents. At least that's what my tests lead me to believe. Stefan