failure in installing xelb: ELPA signature verification failure

failure in installing xelb: ELPA signature verification failure

[Eric S Fraga]

Hello all,

I have just tried to install the xelb package and I get the following
error:

--8<---------------cut here---------------start------------->8---
Failed to verify signature xelb-0.18.tar.sig:
Signature made by expired key 066DAFCB81E42C40 GNU ELPA Signing Agent (2019) <elpasign@elpa.gnu.org>
Command output:
gpg: Signature made Sat 21 Sep 2019 18:56:47 BST
gpg:                using RSA key C433554766D3DDC64221BFAA066DAFCB81E42C40
gpg: Good signature from "GNU ELPA Signing Agent (2019) <elpasign@elpa.gnu.org>" [expired]
gpg: Note: This key has expired!
Primary key fingerprint: C433 5547 66D3 DDC6 4221  BFAA 066D AFCB 81E4 2C40
--8<---------------cut here---------------end--------------->8---

Any suggestions on how to get around this or, better yet, get it fixed?
I guess the problem lies with ELPA?  Package list has been updated etc.
I'm using Emacs 30 from git, updated sometime last week.

Thank you,
eric

-- 
Eric S Fraga via gnus (Emacs 30.0.50 2024-04-17) on Debian bookworm/sid

[SOLVED] Re: failure in installing xelb: ELPA signature verification failure

[Eric S Fraga]

Solved by (temporarily) setting package-check-signature to nil and
installing the package.

Of course, the expired key issue remains for that package.

eric
-- 
Eric S Fraga via gnus (Emacs 30.0.50 2024-04-17) on Debian bookworm/sid

Re: failure in installing xelb: ELPA signature verification failure

[Stefan Monnier via Users list for the GNU Emacs text editor]

> Any suggestions on how to get around this or, better yet, get it fixed?

[ I had put an entry in my agenda to not forget to prepare for the
  end-of-life of that key, but it got lost somehow in the mean time.
  <sigh>.  ]

I'll try and get this fixed ASAP.

[ but of course it had to come at a time where I'm a bit more busy
  than usual.  ]

> I guess the problem lies with ELPA?

Yes.  AFAICT it affects all the packages whose release is "too old"
(hence the signature was made with this old key that has just expired).


        Stefan