bug#23513: package.el treats empty signatures as correct

[Glenn Morris <rgm@gnu.org>]

Dmitry Gutov wrote:

> On 05/11/2016 12:39 PM, L. Dixon wrote:
>
>> I also deleted the skip-unless clause in the package-test-signed,
>> since the test runs normally without it. I may be misunderstanding
>> something here, but I'm worried that skipping this test will mask
>> similar issues or regressions.

No, that stuff is there for a reason. Please don't delete it just
becauses it's not needed on your system.

> That's definitely a cause for concern. Glenn, does Hydra lack the
> necessary libraries to support the package signature check?

Hydra's "gnupg" package is from the 2.0 series, and only provides a
"gpg2" executable. epg-config--program-alist requires something from the
2.1 series. So (epg-find-configuration 'OpenPGP) fails with "no usable
configuration".

I have added "gnupg1" to the requirements for the coverage build in an
effort to get a "gpg" executable. We'll see if this helps.

(It would be easier to see if this worked if the coverage job wasn't
currently failing, as it has been for two weeks, due to network-stream
changes that cause a test failure - bug#23508. This is a repeated pattern
that makes me think people don't actually pay much attention to the
coverage job.)