bug#21314: 24.5; Missing documentation for `package-unsigned-archives' variable

bug#21314: 24.5; Missing documentation for `package-unsigned-archives' variable

[N. Jackson]

The functionality in package.el has been working well for me with Gnu
ELPA for some time. My configuration was this:

    (package-initialize)
    (setq package-check-signature t)

I decided to try out navi-mode from Melpa Stable. Following the
instructions at Melpa [1], my configuration became:

    (package-initialize)
    (setq package-check-signature t)
    (add-to-list 'package-archives
                 '("melpa-stable" . "http://stable.melpa.org/packages/") t)

However, Melpa Stable does not appear to be a signed archive. (No
mention of signing is made on the Melpa site, as far as I could see.)
M-x list-packages RET with this configuration gives the rather
uninformative error message:

    Failed to download `melpa-stable' archive.

(Perhaps this error message could be more detailed?)

Setting debug-on-error, I see this:

    Debugger entered--Lisp error: (error "Unsigned archive `melpa-stable'")
      signal(error ("Unsigned archive `melpa-stable'"))
      error("Unsigned archive `%s'" "melpa-stable")
      package--download-one-archive(("melpa-stable" . "https://stable.melpa.org/packages/") "archive-contents")

As a workaround, I tried:

    (package-initialize)
    (setq package-check-signature nil)
    (add-to-list 'package-archives
                 '("melpa-stable" . "http://stable.melpa.org/packages/") t)

This _does_ work, but I don't want to turn off the checking of
signatures for all archives.

In (info "(emacs) Package Installation"), I read:

    If you use some archives that do not sign their packages, you can add
    them to the list ‘package-unsigned-archives’.

This sounds promising, but it is the only mention of
`package-unsigned-archives' in the manual. (At least, there is just the
one entry in the index.) And the docstring only says:

    List of archives where we do not check for package signatures.

The documentation fails to describe what representation of the archive
must be added to this list. Just its name? It's URL? A symbol
representing the archive? A reference to some object representing the
archive? I tried the following:

    (package-initialize)
    (setq package-check-signature t)
    (add-to-list 'package-archives
                 '("melpa-stable" . "http://stable.melpa.org/packages/") t)
    (add-to-list 'package-unsigned-archives '"melpa-stable")

And also:

    (add-to-list 'package-unsigned-archives '("melpa-stable"))
    (setq package-unsigned-archives (quote ("melpa-stable")))

But in all three cases, I get the same error as I do when I don't try to
set this variable.

FWIW I also get the error with Emacs -Q:

    $ emacs -Q
    M-x package-initialize RET
    M-: (setq package-check-signature t) RET
    M-: (add-to-list 'package-archives '("melpa-stable" . "http://stable.melpa.org/packages/") t) RET
    M-: (add-to-list 'package-unsigned-archives '"melpa-stable") RET
    M-: (setq debug-on-error t) RET
    M-x list-packages RET

Please document the correct way to use the `package-unsigned-archives'
variable.

Thanks.

[1] http://stable.melpa.org/#/getting-started.



In GNU Emacs 24.5.1 (x86_64-unknown-linux-gnu, GTK+ Version 3.14.15)
 of 2015-08-18 on moondust
Windowing system distributor `Fedora Project', version 11.0.11603000
System Description:	Fedora release 21 (Twenty One)

Configured using:
 `configure --prefix=/home/nlj/local/ --enable-checking=yes,glyphs
 'CFLAGS=-O0 -g3 -ggdb''

bug#21314: 24.5; Missing documentation for `package-unsigned-archives' variable

[Lars Ingebrigtsen]

nljlistbox2@gmail.com (N. Jackson) writes:

> This sounds promising, but it is the only mention of
> `package-unsigned-archives' in the manual. (At least, there is just the
> one entry in the index.) And the docstring only says:
>
>     List of archives where we do not check for package signatures.
>
> The documentation fails to describe what representation of the archive
> must be added to this list. Just its name? It's URL? A symbol
> representing the archive? A reference to some object representing the
> archive? I tried the following:

It looks like this has been fixed since this bug was filed, so I'm
closing this bug report:

---
List of archives where we do not check for package signatures.
This should be a list of strings matching the names of package
archives in the variable ‘package-archives’.
---


-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no