bug in handling of package-unsigned-archives

bug in handling of package-unsigned-archives

[Andy Moreton]

Consider the following package archive setup:

(setq package-archives '(("melpa" . "https://melpa.org/packages/")
                         ("gnu"   . "https://elpa.gnu.org/packages/")))
(setq package-check-signature   t)
(setq package-unsigned-archives '("melpa"))

Using "M-x list-packages" results in an error being reported: "Unsigned
file ‘archive-contents’ at https://melpa.org/packages/". This is caused
by an incorrect check in package.el - the following patch fixes it.

2017-02-20  Andy Moreton  <andrewjmoreton@gmail.com>

	Fix check for package-unsigned-archives during retrieval.

	* lisp/emacs-lisp/package.el (package--download-one-archive):
          Fix check for package-unsigned-archives.

diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
index 6728f1b..13b8051 100644
--- a/lisp/emacs-lisp/package.el
+++ b/lisp/emacs-lisp/package.el
@@ -1522,7 +1522,7 @@ package--download-one-archive
       (when (listp (read-from-string content))
         (make-directory dir t)
         (if (or (not package-check-signature)
-                (member archive package-unsigned-archives))
+                (member name package-unsigned-archives))
             ;; If we don't care about the signature, save the file and
             ;; we're done.
             (progn (write-region content nil local-file nil 'silent)

Re: bug in handling of package-unsigned-archives

[Andy Moreton]

Ping!

On Mon 20 Feb 2017, Andy Moreton wrote:

> Consider the following package archive setup:
>
> (setq package-archives '(("melpa" . "https://melpa.org/packages/")
>                          ("gnu"   . "https://elpa.gnu.org/packages/")))
> (setq package-check-signature   t)
> (setq package-unsigned-archives '("melpa"))
>
> Using "M-x list-packages" results in an error being reported: "Unsigned
> file ‘archive-contents’ at https://melpa.org/packages/". This is caused
> by an incorrect check in package.el - the following patch fixes it.
>
> 2017-02-20  Andy Moreton  <andrewjmoreton@gmail.com>
>
> 	Fix check for package-unsigned-archives during retrieval.
>
> 	* lisp/emacs-lisp/package.el (package--download-one-archive):
>           Fix check for package-unsigned-archives.
>
> diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
> index 6728f1b..13b8051 100644
> --- a/lisp/emacs-lisp/package.el
> +++ b/lisp/emacs-lisp/package.el
> @@ -1522,7 +1522,7 @@ package--download-one-archive
>        (when (listp (read-from-string content))
>          (make-directory dir t)
>          (if (or (not package-check-signature)
> -                (member archive package-unsigned-archives))
> +                (member name package-unsigned-archives))
>              ;; If we don't care about the signature, save the file and
>              ;; we're done.
>              (progn (write-region content nil local-file nil 'silent)

Re: bug in handling of package-unsigned-archives

[Richard Copley]

Andy's patch obviously fixes an obvious bug. According to my testing
the bug definitely exists and the the patch definitely fixes it. Would
someone with commit rights please commit it?

On 25 February 2017 at 13:04, Andy Moreton <andrewjmoreton@gmail.com> wrote:
>
> Ping!
>
> On Mon 20 Feb 2017, Andy Moreton wrote:
>
>> Consider the following package archive setup:
>>
>> (setq package-archives '(("melpa" . "https://melpa.org/packages/")
>>                          ("gnu"   . "https://elpa.gnu.org/packages/")))
>> (setq package-check-signature   t)
>> (setq package-unsigned-archives '("melpa"))
>>
>> Using "M-x list-packages" results in an error being reported: "Unsigned
>> file ‘archive-contents’ at https://melpa.org/packages/". This is caused
>> by an incorrect check in package.el - the following patch fixes it.
>>
>> 2017-02-20  Andy Moreton  <andrewjmoreton@gmail.com>
>>
>>       Fix check for package-unsigned-archives during retrieval.
>>
>>       * lisp/emacs-lisp/package.el (package--download-one-archive):
>>           Fix check for package-unsigned-archives.
>>
>> diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
>> index 6728f1b..13b8051 100644
>> --- a/lisp/emacs-lisp/package.el
>> +++ b/lisp/emacs-lisp/package.el
>> @@ -1522,7 +1522,7 @@ package--download-one-archive
>>        (when (listp (read-from-string content))
>>          (make-directory dir t)
>>          (if (or (not package-check-signature)
>> -                (member archive package-unsigned-archives))
>> +                (member name package-unsigned-archives))
>>              ;; If we don't care about the signature, save the file and
>>              ;; we're done.
>>              (progn (write-region content nil local-file nil 'silent)
>
>

Re: bug in handling of package-unsigned-archives

[Dmitry Gutov]

On 6/5/17 7:18 PM, Richard Copley wrote:
> Andy's patch obviously fixes an obvious bug. According to my testing
> the bug definitely exists and the the patch definitely fixes it. Would
> someone with commit rights please commit it?

Done.	

Re: bug in handling of package-unsigned-archives

[Dmitry Gutov]

On 2/20/17 5:50 PM, Andy Moreton wrote:

> Using "M-x list-packages" results in an error being reported: "Unsigned
> file ‘archive-contents’ at https://melpa.org/packages/". This is caused
> by an incorrect check in package.el - the following patch fixes it.

Thank you, patch installed.

Please send it as a .patch file new time, though, so I don't need to 
copy-paste stuff from here to there. Especially if the next patch is bigger.