From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Glenn Morris Newsgroups: gmane.emacs.bugs Subject: bug#17625: 24.4.50; All installed packages marked "unsigned", no archive listed Date: Sat, 21 Jun 2014 19:50:57 -0400 Message-ID: References: <87tx89ffax.fsf@pellet.i-did-not-set--mail-host-address--so-tickle-me> <2vvbsnrgpk.fsf@fencepost.gnu.org> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1403394734 17063 80.91.229.3 (21 Jun 2014 23:52:14 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 21 Jun 2014 23:52:14 +0000 (UTC) To: 17625@debbugs.gnu.org Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Sun Jun 22 01:52:08 2014 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1WyV4o-00024c-OB for geb-bug-gnu-emacs@m.gmane.org; Sun, 22 Jun 2014 01:52:06 +0200 Original-Received: from localhost ([::1]:47014 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WyV4o-00018L-EB for geb-bug-gnu-emacs@m.gmane.org; Sat, 21 Jun 2014 19:52:06 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:35906) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WyV4l-00018G-4x for bug-gnu-emacs@gnu.org; Sat, 21 Jun 2014 19:52:03 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WyV4k-0000jp-7t for bug-gnu-emacs@gnu.org; Sat, 21 Jun 2014 19:52:03 -0400 Original-Received: from debbugs.gnu.org ([140.186.70.43]:37129) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WyV4k-0000jk-4I for bug-gnu-emacs@gnu.org; Sat, 21 Jun 2014 19:52:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.80) (envelope-from ) id 1WyV4j-0000bQ-Rc for bug-gnu-emacs@gnu.org; Sat, 21 Jun 2014 19:52:01 -0400 X-Loop: help-debbugs@gnu.org In-Reply-To: <87tx89ffax.fsf@pellet.i-did-not-set--mail-host-address--so-tickle-me> Resent-From: Glenn Morris Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sat, 21 Jun 2014 23:52:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 17625 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: Original-Received: via spool by 17625-submit@debbugs.gnu.org id=B17625.14033946622250 (code B ref 17625); Sat, 21 Jun 2014 23:52:01 +0000 Original-Received: (at 17625) by debbugs.gnu.org; 21 Jun 2014 23:51:02 +0000 Original-Received: from localhost ([127.0.0.1]:56512 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1WyV3l-0000a2-EV for submit@debbugs.gnu.org; Sat, 21 Jun 2014 19:51:01 -0400 Original-Received: from fencepost.gnu.org ([208.118.235.10]:59322 ident=Debian-exim) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1WyV3i-0000Zj-Lc for 17625@debbugs.gnu.org; Sat, 21 Jun 2014 19:50:59 -0400 Original-Received: from rgm by fencepost.gnu.org with local (Exim 4.71) (envelope-from ) id 1WyV3h-0001Fo-PL; Sat, 21 Jun 2014 19:50:57 -0400 X-Spook: Ansar al-Islam Ron Brown CipherTAC-2000 Croatian X-Ran: M`)6ag3vpEOM86Ed?O2g6Kdo}{3dHVyaaavexUU4\"Y:`o,ub_!gXWdbz1JV List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:90651 Archived-At: Glenn Morris wrote: > I suggest creating a test package on elpa.gnu.org that is signed to see > how it works. Is anyone interested in doing this? This feature seems like it might be almost there, so IMO it would seem like a shame to release 24.4 without ever testing this in the wild. > If package-check-signature has its default value, `allow-unsigned', you > can happily install a package with no signature, but trying to install > one that _is_ signed, but for which you don't have the public key, fails > with "Failed to verify signature". I think that is a potential show-stopper. Perhaps archives could also provide keys for download in a standard location. The first time you connect to a given archive, Emacs could offer to download and import the key (with a suitable warning). Or is this crazy?