Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Nicky Chorley]

Hi all,

I'm running Emacs 25.3.1 on Slackware Linux 14.2 and `M-x
package-refresh-contents` is giving the following error:

Failed to verify signature archive-contents.sig:
Bad signature from 474F05837FBDEF9B GNU ELPA Signing Agent
<elpasign@elpa.gnu.org>
Command output:
gpg: Signature made Fri 08 Feb 2019 10:15:04 PM GMT using DSA key ID 7FBDEF9B
gpg: BAD signature from "GNU ELPA Signing Agent <elpasign@elpa.gnu.org>"

I don't recall changing anything in my config recently. Just to see if
that was causing a problem, I did remove my config (.emacs and
.emacs.d), but the problem persisted.

Any ideas about what's causing this?

Thanks,

Nicky Chorley

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Robert Pluim]

Nicky Chorley <nick.chorley@gmail.com> writes:

> Hi all,
>
> I'm running Emacs 25.3.1 on Slackware Linux 14.2 and `M-x
> package-refresh-contents` is giving the following error:
>
> Failed to verify signature archive-contents.sig:
> Bad signature from 474F05837FBDEF9B GNU ELPA Signing Agent
> <elpasign@elpa.gnu.org>
> Command output:
> gpg: Signature made Fri 08 Feb 2019 10:15:04 PM GMT using DSA key ID 7FBDEF9B
> gpg: BAD signature from "GNU ELPA Signing Agent <elpasign@elpa.gnu.org>"
>
> I don't recall changing anything in my config recently. Just to see if
> that was causing a problem, I did remove my config (.emacs and
> .emacs.d), but the problem persisted.
>
> Any ideas about what's causing this?

My crystal ball says youʼre using http to download the archives. Try
switching to https.

If that solves it you have a broken proxy somewhere between you and
the package archive server.

Robert

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Stefan Monnier]

> I'm running Emacs 25.3.1 on Slackware Linux 14.2 and `M-x
> package-refresh-contents` is giving the following error:
>
> Failed to verify signature archive-contents.sig:

FWIW, the build scripts on elpa.gnu.org can occasionally end up with
a stale .sig for a short amount of time (known problem that we should
fix, obviously, but not high enough on the todo list), so maybe you just
got unlucky.

In any case, please report those problems via `M-x report-emacs-bug`.


        Stefan

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Nicky Chorley]

I tried switching to HTTPS for the GNU ELPA repository as well, but
that didn't help either and I'm still getting the error. Again, just
clearing my .emacs.d doesn't help. Is there another cache somewhere
that I should try clearing, or does anyone have any other suggestions?

Best,

Nicky

On Sat, 9 Feb 2019 at 08:46, Nicky Chorley <nick.chorley@gmail.com> wrote:
>
> Hi all,
>
> I'm running Emacs 25.3.1 on Slackware Linux 14.2 and `M-x
> package-refresh-contents` is giving the following error:
>
> Failed to verify signature archive-contents.sig:
> Bad signature from 474F05837FBDEF9B GNU ELPA Signing Agent
> <elpasign@elpa.gnu.org>
> Command output:
> gpg: Signature made Fri 08 Feb 2019 10:15:04 PM GMT using DSA key ID 7FBDEF9B
> gpg: BAD signature from "GNU ELPA Signing Agent <elpasign@elpa.gnu.org>"
>
> I don't recall changing anything in my config recently. Just to see if
> that was causing a problem, I did remove my config (.emacs and
> .emacs.d), but the problem persisted.
>
> Any ideas about what's causing this?
>
> Thanks,
>
> Nicky Chorley

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Jude DaShiell]

I had problems with that earlier too.
It was because I didn't have the latest tls package installed.
This didn't used to be necessary but now appears necessary.

On Sat, 9 Mar 2019, Nicky Chorley wrote:

> Date: Sat, 9 Mar 2019 01:52:18
> From: Nicky Chorley <nick.chorley@gmail.com>
> To: help-gnu-emacs@gnu.org
> Subject: Re: Unable to use `package-refresh-contents`: Bad signature from GNU
>     ELPA Signing Agent
>
> I tried switching to HTTPS for the GNU ELPA repository as well, but
> that didn't help either and I'm still getting the error. Again, just
> clearing my .emacs.d doesn't help. Is there another cache somewhere
> that I should try clearing, or does anyone have any other suggestions?
>
> Best,
>
> Nicky
>
> On Sat, 9 Feb 2019 at 08:46, Nicky Chorley <nick.chorley@gmail.com> wrote:
> >
> > Hi all,
> >
> > I'm running Emacs 25.3.1 on Slackware Linux 14.2 and `M-x
> > package-refresh-contents` is giving the following error:
> >
> > Failed to verify signature archive-contents.sig:
> > Bad signature from 474F05837FBDEF9B GNU ELPA Signing Agent
> > <elpasign@elpa.gnu.org>
> > Command output:
> > gpg: Signature made Fri 08 Feb 2019 10:15:04 PM GMT using DSA key ID 7FBDEF9B
> > gpg: BAD signature from "GNU ELPA Signing Agent <elpasign@elpa.gnu.org>"
> >
> > I don't recall changing anything in my config recently. Just to see if
> > that was causing a problem, I did remove my config (.emacs and
> > .emacs.d), but the problem persisted.
> >
> > Any ideas about what's causing this?
> >
> > Thanks,
> >
> > Nicky Chorley
>
>

-- 

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Stefan Monnier]

> It was because I didn't have the latest tls package installed.
> This didn't used to be necessary but now appears necessary.

I don't know of any `tls.el` package other than a very old one that
should be considered deprecated nowadays (and still comes bundled with
Emacs in `lisp/obsolete/tls.el`).  The SSL/TLS handling in Emacs
nowadays is handled by the libgnutls code, so it doesn't require any
Elisp package.  If that doesn't work well for you please `M-x
report-emacs-bug`.


        Stefan

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Jude DaShiell]

I should have been more transparent, the tls package I installed came
from the slint repository not any part of emacs.

On Sat, 9 Mar 2019, Stefan Monnier wrote:

> Date: Sat, 9 Mar 2019 15:15:56
> From: Stefan Monnier <monnier@iro.umontreal.ca>
> To: help-gnu-emacs@gnu.org
> Subject: Re: Unable to use `package-refresh-contents`: Bad signature from GNU
>     ELPA Signing Agent
>
> > It was because I didn't have the latest tls package installed.
> > This didn't used to be necessary but now appears necessary.
>
> I don't know of any `tls.el` package other than a very old one that
> should be considered deprecated nowadays (and still comes bundled with
> Emacs in `lisp/obsolete/tls.el`).  The SSL/TLS handling in Emacs
> nowadays is handled by the libgnutls code, so it doesn't require any
> Elisp package.  If that doesn't work well for you please `M-x
> report-emacs-bug`.
>
>
>         Stefan
>
>
>

-- 

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Nicky Chorley]

Well, I upgraded GnuTLS to 3.6.7 (the latest in Slackware's repos),
but nothing changed. I also tried building the latest version of Emacs
(26.2) just to see if it made a difference, but it didn't.

I also realised that my version of GnuPG 2 is quite old, but don't
know what else is using that. So, I just tried
package-refresh-contents on Emacs 26.2 on a Fedora 30 install (albeit
inside a Docker container), which has a much newer version of GnuPG 2
(2.2.13). The same problem occurred.

This is extremely frustrating!

On Sat, 9 Mar 2019 at 07:57, Jude DaShiell <jdashiel@panix.com> wrote:
>
> I had problems with that earlier too.
> It was because I didn't have the latest tls package installed.
> This didn't used to be necessary but now appears necessary.
>
> On Sat, 9 Mar 2019, Nicky Chorley wrote:
>
> > Date: Sat, 9 Mar 2019 01:52:18
> > From: Nicky Chorley <nick.chorley@gmail.com>
> > To: help-gnu-emacs@gnu.org
> > Subject: Re: Unable to use `package-refresh-contents`: Bad signature from GNU
> >     ELPA Signing Agent
> >
> > I tried switching to HTTPS for the GNU ELPA repository as well, but
> > that didn't help either and I'm still getting the error. Again, just
> > clearing my .emacs.d doesn't help. Is there another cache somewhere
> > that I should try clearing, or does anyone have any other suggestions?
> >
> > Best,
> >
> > Nicky
> >
> > On Sat, 9 Feb 2019 at 08:46, Nicky Chorley <nick.chorley@gmail.com> wrote:
> > >
> > > Hi all,
> > >
> > > I'm running Emacs 25.3.1 on Slackware Linux 14.2 and `M-x
> > > package-refresh-contents` is giving the following error:
> > >
> > > Failed to verify signature archive-contents.sig:
> > > Bad signature from 474F05837FBDEF9B GNU ELPA Signing Agent
> > > <elpasign@elpa.gnu.org>
> > > Command output:
> > > gpg: Signature made Fri 08 Feb 2019 10:15:04 PM GMT using DSA key ID 7FBDEF9B
> > > gpg: BAD signature from "GNU ELPA Signing Agent <elpasign@elpa.gnu.org>"
> > >
> > > I don't recall changing anything in my config recently. Just to see if
> > > that was causing a problem, I did remove my config (.emacs and
> > > .emacs.d), but the problem persisted.
> > >
> > > Any ideas about what's causing this?
> > >
> > > Thanks,
> > >
> > > Nicky Chorley
> >
> >
>
> --
>

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Van L]

Nicky Chorley <nick.chorley@gmail.com> writes:

￨ Well, I upgraded GnuTLS to 3.6.7 (the latest in Slackware's repos),
￨ but nothing changed. I also tried building the latest version of Emacs
￨ (26.2) just to see if it made a difference, but it didn't.
￨
￨ I also realised that my version of GnuPG 2 is quite old, but don't
￨ know what else is using that. So, I just tried
￨ package-refresh-contents on Emacs 26.2 on a Fedora 30 install (albeit
￨ inside a Docker container), which has a much newer version of GnuPG 2
￨ (2.2.13). The same problem occurred.
￨
￨ This is extremely frustrating!

Is the 'gnu-elpa-keyring-update' package any help?

The blurb says,

--8<---------------cut here---------------start------------->8---
This package updates the GPG keys used by the ELPA package manager
(a.k.a `package.el') to verify authenticity of packages downloaded
from the GNU ELPA archive.
--8<---------------cut here---------------end--------------->8---



-- 
© 2019 Van L
gpg using EEF2 37E9 3840 0D5D 9183  251E 9830 384E 9683 B835
           "you have to be Albert Einstein to figure it out" - Donald J. Trump

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Nicky Chorley]

Hi Van,

I've only just seen your message.

I installed the gnu-elpa-keyring-update package as you suggested
(albeit manually, with "M-x package-install-file", since the
instructions listed on the project page didn't work (it seems they're
for a different version of gpg than what I have). The package didn't
seem to have much documentation, so I wasn't sure if I needed to do
anything after installing it. In any case, just running "M-x
package-refresh-contents" after installing it showed the same problem.

Best,

Nicky

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[VanL]

> On 22 Jun 2019, at 17:26, Nicky Chorley <nick.chorley@gmail.com> wrote:
> 
> I installed the gnu-elpa-keyring-update package as you suggested
> (albeit manually, with "M-x package-install-file", since the
> instructions listed on the project page didn't work (it seems they're
> for a different version of gpg than what I have). The package didn't
> seem to have much documentation, so I wasn't sure if I needed to do
> anything after installing it. In any case, just running "M-x
> package-refresh-contents" after installing it showed the same problem.

May be you need to locate your gpg program and put it in .emacs like

(setq epg-gpg-program "/usr/local/bin/gpg2")

May be you need to update your gpg.

It would be neat to have a thing that checklisted all your certificate handling components are working correctly.

My be you could point eww to the https address for the packages and see if your emacs can get thru to there.

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Stefan Monnier]

> I installed the gnu-elpa-keyring-update package as you suggested

Good.  This package is useless right now but will be needed by the end
of the summer when we switch to the new keys, so it's good that you
installed it.

> (albeit manually, with "M-x package-install-file", since the
> instructions listed on the project page didn't work (it seems they're
> for a different version of gpg than what I have).

The instructions are for the case where you can't install the package.
I'd be interested to know how they failed for you, so I can try and
improve the information I give there.  Can you email me the details?

> The package didn't seem to have much documentation, so I wasn't sure
> if I needed to do anything after installing it.

No, there should be nothing more to do other than installing it (and
updating it every few years).

> In any case, just running "M-x package-refresh-contents" after
> installing it showed the same problem.

Of course: the bad-signature problem is something different.
There was a bug that shows exactly this symptom, which we have fixed in
the upcoming 26.3.  Could you try the 26.2.90 pretest to confirm that it
fixes the problem for you?


        Stefan

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Nicky Chorley]

On Sat, 22 Jun 2019 at 14:04, VanL <van@scratch.space> wrote:

> May be you need to locate your gpg program and put it in .emacs like
>
> (setq epg-gpg-program "/usr/local/bin/gpg2")
>
> May be you need to update your gpg.
>
> It would be neat to have a thing that checklisted all your certificate handling components are working correctly.
>
> My be you could point eww to the https address for the packages and see if your emacs can get thru to there.>
>

The version of gpg2 on Slackware is quite old, so I tried the
following .emacs on Fedora 30 (which has a much newer gpg2) running
inside a Docker container

(setq epg-gpg-program "/usr/bin/gpg2")
(setq package-archives '(("gnu" . "https://elpa.gnu.org/packages/")))

but no joy.

Is there a way I can get Emacs to tell me how it's downloading the
file and how it's running gpg2 to verify it? I'd like to try the same
outside Emacs to see if I can reproduce the problem.

In any case, I found this bug:
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=35534, so maybe we just
have to wait and see what the maintainers find.

Best,

Nicky

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[VanL]

> On 23 Jun 2019, at 14:50, Nicky Chorley <nick.chorley@gmail.com> wrote:
> 
> (setq package-archives '(("gnu" . "https://elpa.gnu.org/packages/")))

At the top of my .emacs is the following...

--8<---------------cut here---------------start------------->8---
(package-initialize)
(setq package-archives '(("gnu" . "https://elpa.gnu.org/packages/")
			 ("org" . "https://orgmode.org/elpa/")
			 ("melpa" . "https://melpa.org/packages/")))
--8<---------------cut here---------------end--------------->8---

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Nicky Chorley]

Putting

(package-initialize)

at the top didn't help either (and FWIW I copied and pasted the whole thing).

Also, I tried

$  wget https://elpa.gnu.org/packages/archive-contents{,.sig} && gpg2
--homedir ~/.emacs.d/elpa/gnupg/ --verify archive-contents.sig

... wget output omitted for brevity...

gpg: assuming signed data in 'archive-contents'
gpg: Signature made Sun 23 Jun 2019 10:10:02 AM BST using DSA key ID 7FBDEF9B
gpg: Good signature from "GNU ELPA Signing Agent
<elpasign@elpa.gnu.org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: CA44 2C00 F917 74F1 7F59  D9B0 474F 0583 7FBD EF9B

So, it seems that gpg2 can verify the signature perfectly well.

Best,

Nicky

On Sun, 23 Jun 2019 at 12:50, VanL <van@scratch.space> wrote:
>
>
> > On 23 Jun 2019, at 14:50, Nicky Chorley <nick.chorley@gmail.com> wrote:
> >
> > (setq package-archives '(("gnu" . "https://elpa.gnu.org/packages/")))
>
> At the top of my .emacs is the following...
>
> --8<---------------cut here---------------start------------->8---
> (package-initialize)
> (setq package-archives '(("gnu" . "https://elpa.gnu.org/packages/")
>                          ("org" . "https://orgmode.org/elpa/")
>                          ("melpa" . "https://melpa.org/packages/")))
> --8<---------------cut here---------------end--------------->8---
>
>

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Jude DaShiell]

Before (package-initialize) you need (require 'package).
On Sun, 23 Jun
2019, VanL wrote:

> Date: Sun, 23 Jun 2019 07:50:38
> From: VanL <van@scratch.space>
> To: Nicky Chorley <nick.chorley@gmail.com>
> Cc: help-gnu-emacs@gnu.org
> Subject: Re: Unable to use `package-refresh-contents`: Bad signature from GNU
>     ELPA Signing Agent
>
>
> > On 23 Jun 2019, at 14:50, Nicky Chorley <nick.chorley@gmail.com> wrote:
> >
> > (setq package-archives '(("gnu" . "https://elpa.gnu.org/packages/")))
>
> At the top of my .emacs is the following...
>
> --8<---------------cut here---------------start------------->8---
> (package-initialize)
> (setq package-archives '(("gnu" . "https://elpa.gnu.org/packages/")
> 			 ("org" . "https://orgmode.org/elpa/")
> 			 ("melpa" . "https://melpa.org/packages/")))
> --8<---------------cut here---------------end--------------->8---
>
>
>
>

-- 

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[VanL]

> On 24 Jun 2019, at 00:19, Nicky Chorley <nick.chorley@gmail.com> wrote:
> 
> So, it seems that gpg2 can verify the signature perfectly well.

You could try renaming your .emacs file and .emac.d directory so that they won't be used.  Then see if you are able to install the 'which-key' package on Emacs 26.1 or 26.2 or 27.  There are different ways to load packages.  You could try a different way by following a techtube howto guide.

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Stefan Monnier]

> Before (package-initialize) you need (require 'package).

package-initialize is autoloaded, so I don't see why you'd need that here.


        Stefan

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Stefan Monnier]

> Putting
> (package-initialize)
> at the top didn't help either (and FWIW I copied and pasted the whole thing).

Of course it didn't.  Did you try 26.2.90 like I recommended?

> So, it seems that gpg2 can verify the signature perfectly well.

Yes, the problem is most likely the one we fixed in 26.2.90 (i.e. Emacs
messes up the bytes along the way).


        Stefan

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Nicky Chorley]

On Sun, 23 Jun 2019 at 19:21, Jude DaShiell <jdashiel@panix.com> wrote:
>
> Before (package-initialize) you need (require 'package).

Sadly that did not help either.

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Nicky Chorley]

On Mon, 24 Jun 2019 at 09:14, VanL <van@scratch.space> wrote:
> You could try renaming your .emacs file and .emac.d directory so that they won't be used. Then see if you are able to install the 'which-key' package on Emacs 26.1 or 26.2 or 27.

I've gone through various iterations of removing those and renaming
them and that hasn't helped in any case :(. Still can't install
packages.

> There are different ways to load packages.  You could try a different way by following a techtube howto guide.

I've found out about el-get, straight.el and others, so I'll give one
of them a go.

Thanks.

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Jude DaShiell]

I used the (add-to-list code to add elpa and melpa in my .emacs file and
that may be working.  Why the code in emacswiki shown above the
(add-to-list doesn't work I don't know.  I could add melpa but not elpa if
melpa got added first.  If I tried adding elpa first it appears as if the


(package-initialize)
(setq epg-gpg-program "/usr/bin/gpg2")
(add-to-list 'package-archives '("melpa" . "https://melpa.org/packages/")
'("gnu" . "https://elpa.gnu.org/packages/"))
package failed on that refresh attempt and melpa was never refreshed. On
Mon, 24 Jun 2019, Nicky Chorley wrote:


> Date: Mon, 24 Jun 2019 14:58:02
> From: Nicky Chorley <nick.chorley@gmail.com>
> To: Jude DaShiell <jdashiel@panix.com>
> Cc: VanL <van@scratch.space>, help-gnu-emacs@gnu.org
> Subject: Re: Unable to use `package-refresh-contents`: Bad signature from GNU
>     ELPA Signing Agent
>
> On Sun, 23 Jun 2019 at 19:21, Jude DaShiell <jdashiel@panix.com> wrote:
> >
> > Before (package-initialize) you need (require 'package).
>
> Sadly that did not help either.
>
>

-- 

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[VanL]

> On 25 Jun 2019, at 05:00, Nicky Chorley <nick.chorley@gmail.com> wrote:
> 
> On Mon, 24 Jun 2019 at 09:14, VanL <van@scratch.space> wrote:
>> You could try renaming your .emacs file and .emac.d directory so that they won't be used. Then see if you are able to install the 'which-key' package on Emacs 26.1 or 26.2 or 27.
> 
> I've gone through various iterations of removing those and renaming
> them and that hasn't helped in any case :(. Still can't install
> packages.

I was able to install which-key and hyperbole from the gnu-package source but org on 26.1/openbsd-6.5 stopped unexpectedly and I had to use the org-package source directly.

On 26.2/netbsd8.1 I can't update the package list.  The final message says 'error in process sentinel: End of file during parsing' and the *Messages* buffer says...  and this is possibly due to inconsistency in the pkgsrc versions of components yoyoing between 8.0 and 8.1 and experimental current.

--8<---------------cut here---------------start------------->8---
Importing package-keyring.gpg...done
error in process sentinel: Error retrieving: https://melpa.org/packages/archive-contents "incomprehensible buffer" [2 times]
error in process sentinel: End of file during parsing [2 times]
Updating buffer list...done
--8<---------------cut here---------------end--------------->8---

You may want to look in *Messages* buffer for clues.

>> There are different ways to load packages.  You could try a different way by following a techtube howto guide.
> 
> I've found out about el-get, straight.el and others, so I'll give one
> of them a go.

One mechanism I might try is 'use-package'.

Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Nicky Chorley]

Hi Stefan, others,

I can confirm that 26.2.90 does work for me. Thanks for the fix!

Best,

Nicky