bug#27796: 26.0.50; elpa unsigned file archive-contents

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Mark Oteiza]

Hi,

1. HOME=/somewhere/else emacs -nw -Q
2. (require 'package)
3. (setq-default package-check-signature t)
4. M-x list-packages

  error in process filter: Unsigned file `archive-contents' at https://elpa.gnu.org/packages/ [2 times]

Repository revision: 640fc129fdf75c86c43ce15b0215d224e240052f

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Glenn Morris]

Mark Oteiza wrote:

>   error in process filter: Unsigned file `archive-contents' at
> https://elpa.gnu.org/packages/ [2 times]

Looks like http://elpa.gnu.org/packages/archive-contents.sig exists,
but is not a valid signature file?

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Glenn Morris]

Glenn Morris wrote:

> Looks like http://elpa.gnu.org/packages/archive-contents.sig exists,
> but is not a valid signature file?

Sorry, ignore that. It works fine with:

  gpg --homedir ~/.emacs.d/elpa/gnupg --verify archive-contents.sig 

(Albeit with the issue from https://debbugs.gnu.org/25532, which does
not affect the exit status for me, but might depending on the user's gpg
configuration, I guess.)

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Glenn Morris]

I feel like sometimes this works for me, and sometimes it doesn't.

It's not helpful that package.el simply prints "unsigned file" for all
such errors, rather than showing the actual problem.

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Mark Oteiza]

On 24/07/17 at 03:24pm, Glenn Morris wrote:
>
>I feel like sometimes this works for me, and sometimes it doesn't.

Same, I idly called M-x list-packages a few times in a row and it
stopped erroring.  Restarted emacs, list-packages started erroring again.

>It's not helpful that package.el simply prints "unsigned file" for all
>such errors, rather than showing the actual problem.

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Glenn Morris]

After faffing around with debug statements, I think the problem is that
sometimes url-retrieving "https://elpa.gnu.org/packages/archive-contents.sig"
returns
    
    HTTP/1.1 400 Bad Request
    [...]
    Your browser sent a request that this server could not understand.
    Reason: You're speaking plain HTTP to an SSL-enabled server port.
     Instead use the HTTPS scheme to access this URL, please.

I have no idea whether this is a problem in url.el or elpa.gnu.org.

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Glenn Morris]

I feel like (setq url-http-attempt-keepalives nil) stops the problem
from happening (as well as speeding things up?).

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Mark Oteiza]

On 25/07/17 at 02:21pm, Glenn Morris wrote:
>I feel like (setq url-http-attempt-keepalives nil) stops the problem
>from happening (as well as speeding things up?).

I see the same effect.

HTTP/1.1 (url-http-version indicates "1.1") doesn't need this header.

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Mark Oteiza]

On 24/07/17 at 02:25pm, Glenn Morris wrote:
>Glenn Morris wrote:
>
>> Looks like http://elpa.gnu.org/packages/archive-contents.sig exists,
>> but is not a valid signature file?
>
>Sorry, ignore that. It works fine with:
>
>  gpg --homedir ~/.emacs.d/elpa/gnupg --verify archive-contents.sig
>
>(Albeit with the issue from https://debbugs.gnu.org/25532, which does
>not affect the exit status for me, but might depending on the user's gpg
>configuration, I guess.)

Here, I do get the same warning as in that bug, as well as exit status 0.

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Stefan Monnier]

>> error in process filter: Unsigned file `archive-contents' at
>> https://elpa.gnu.org/packages/ [2 times]

> Looks like http://elpa.gnu.org/packages/archive-contents.sig exists,
> but is not a valid signature file?

Hmm... works here:

    % gpg --homedir ~/.emacs.d/elpa/gnupg/ archive-contents.sig                 
    gpg: WARNING: no command supplied.  Trying to guess what you mean ...
    gpg: assuming signed data in 'archive-contents'
    gpg: Signature made lun 24 jui 2017 05:10:02 EDT
    gpg:                using DSA key CA442C00F91774F17F59D9B0474F05837FBDEF9B
    gpg: Good signature from "GNU ELPA Signing Agent <elpasign@elpa.gnu.org>" [unknown]
    gpg: WARNING: This key is not certified with a trusted signature!
    gpg:          There is no indication that the signature belongs to the owner.
    Primary key fingerprint: CA44 2C00 F917 74F1 7F59  D9B0 474F 0583 7FBD EF9B
    % 


-- Stefan

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Stefan Kangas]

Glenn Morris <rgm@gnu.org> writes:

> Mark Oteiza wrote:
>
>>   error in process filter: Unsigned file `archive-contents' at
>> https://elpa.gnu.org/packages/ [2 times]
>
> Looks like http://elpa.gnu.org/packages/archive-contents.sig exists,
> but is not a valid signature file?

FWIW, I've never seen this.  Is this still an issue?

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Mark Oteiza]

On 08/09/20 at 02:05pm, Stefan Kangas wrote:
> Glenn Morris <rgm@gnu.org> writes:
> 
> > Mark Oteiza wrote:
> >
> >>   error in process filter: Unsigned file `archive-contents' at
> >> https://elpa.gnu.org/packages/ [2 times]
> >
> > Looks like http://elpa.gnu.org/packages/archive-contents.sig exists,
> > but is not a valid signature file?
> 
> FWIW, I've never seen this.  Is this still an issue?

I haven't been using package archives very much, but I'm currently not
seeing it when listing/updating packages, or running the recipe from the
original report.

bug#27796: 26.0.50; elpa unsigned file archive-contents

[Lars Ingebrigtsen]

Mark Oteiza <mvoteiza@udel.edu> writes:

> I haven't been using package archives very much, but I'm currently not
> seeing it when listing/updating packages, or running the recipe from the
> original report.

(I'm going through old bug reports that unfortunately weren't resolved
at the time.)

It sounds like it was a transitory problem with fetching the .sig file?
In which case I don't think there's much to be done on the Emacs side,
and I'm closing this bug report.  If there's something here that should
be worked on, please respond to the debbugs address and we'll reopen.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no