bug#35739: Bad signature from GNU ELPA

[Eli Zaretskii <eliz@gnu.org>]

> From: Stefan Monnier <monnier@iro.umontreal.ca>
> Cc: rcopley@gmail.com,  35739@debbugs.gnu.org,  npostavs@gmail.com
> Date: Wed, 22 May 2019 15:40:46 -0400
> 
> > You refrain from decoding what?
> 
> The files we download.
> 
> > E.g., Lisp files must be in UTF-8, right?
> 
> At first we don't care: we gets files (tarballs, GPG signatures, Elisp
> files, ...) and while some of them may need decoding later on, not all
> do.  And for purposes of signature checking, for some of those files we
> need to get the exact original sequence of bytes, which is easier to get
> if we only decode *after* signature checking rather than before.
> For this reason we don't want to let URL do the decoding for us.

Where is the decoding happening, then?  According to what you write,
URL should just save the files as is, and then decoding should happen
when we access the resulting files after saving them.  Is that what
happens after the changes?

> > And what about the descriptions we show in lisp-packages?
> 
> Not sure what you mean by that (I already mentioned the *-readme.txt
> files which we do decode explicitly now).
> 
> > Or maybe I don't really understand why we need to decode _anything_,
> > since we just download a .tar archive, right?

Sorry for the typo: I meant list-packages.  Does that display come
from the README files?

> >> Yes, this part should definitely not be in emacs-26.
> > I'm actually asking why it should be on master.
> 
> It seemed like a simple way to provide this new functionality.
> The functionality is needed at least by package.el, and I see no reason
> why it should be the only client of URL that needs this functionality.

Other clients might need it in other ways.  From what you explain, it
sounds like package.el doesn't need to decode at all when it
downloads, so it should disregard the 'charset' header and always
treat the stuff it gets as a raw byte stream.  Is that correct?  If it
is correct, then there's no need to make any changes in url*.el
routines.