bug#33825: 25.2; Failing to verify signature for ELPA debbugs package

bug#33825: 25.2; Failing to verify signature for ELPA debbugs package

[clemera]

Hi,

I get the following error when I try to install debbugs package:


Failed to verify signature debbugs-0.16.tar.sig:
Bad signature from 474F05837FBDEF9B GNU ELPA Signing Agent 
<elpasign@elpa.gnu.org>
Command output:
gpg: Signature made Wed Oct 17 11:10:03 2018 CEST
gpg:                using DSA key CA442C00F91774F17F59D9B0474F05837FBDEF9B
gpg: BAD signature from "GNU ELPA Signing Agent <elpasign@elpa.gnu.org>" 
[unknown]

bug#33825: 25.2; Failing to verify signature for ELPA debbugs package

[Glenn Morris]

clemera wrote:

> Failed to verify signature debbugs-0.16.tar.sig:
> Bad signature from 474F05837FBDEF9B GNU ELPA Signing Agent
> <elpasign@elpa.gnu.org>
> Command output:
> gpg: Signature made Wed Oct 17 11:10:03 2018 CEST
> gpg:                using DSA key CA442C00F91774F17F59D9B0474F05837FBDEF9B
> gpg: BAD signature from "GNU ELPA Signing Agent
> <elpasign@elpa.gnu.org>" [unknown]

FWIW, it verifies fine here with Emacs 25.2, and also manually using
wget https://elpa.gnu.org/packages/debbugs-0.16.tar and tar.sig.

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[clemera]

 > FWIW, it verifies fine here with Emacs 25.2

I tried it again and now it works for me, too. Strange..., what could 
have caused that it failed before?

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[Robert Pluim]

clemera <clemens.radermacher@posteo.de> writes:

>> FWIW, it verifies fine here with Emacs 25.2
>
> I tried it again and now it works for me, too. Strange..., what could
> have caused that it failed before?

There are 'transparent' proxies which will untar archives and then
retar them, resulting in a file that fails signature verification even
though the contents are identical. When you then repeat the download,
the proxy knows it has previously inspected the file, and thus lets
through the original. Using https solves this issue 99% of the time.

If youʼre using https already, then Iʼm out of ideas :-)

Robert

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[Clemens Radermacher]

On 30.12.18 13:12, Robert Pluim wrote:

> There are 'transparent' proxies which will untar archives and then
> retar them, resulting in a file that fails signature verification even
> though the contents are identical. When you then repeat the download,
> the proxy knows it has previously inspected the file, and thus lets
> through the original. Using https solves this issue 99% of the time.

That's interesting thanks! For GNU ELPA I use http indeed, because I rely on Emacs 
taking care of the verification. I don't understand why those proxies should 
unpack archives though, is that for filtering purposes?

-- 
Clemens

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[Robert Pluim]

Clemens Radermacher <clemens.radermacher@posteo.de> writes:

> On 30.12.18 13:12, Robert Pluim wrote:
>
>> There are 'transparent' proxies which will untar archives and then
>> retar them, resulting in a file that fails signature verification even
>> though the contents are identical. When you then repeat the download,
>> the proxy knows it has previously inspected the file, and thus lets
>> through the original. Using https solves this issue 99% of the time.
>
> That's interesting thanks! For GNU ELPA I use http indeed, because I rely on Emacs 
> taking care of the verification. I don't understand why those proxies should 
> unpack archives though, is that for filtering purposes?

In enlightened democracies they want to see if there is any malware
hiding inside. In other types of countries they're filtering
'undesirable' content. Identifying which type youʼre living in is
becoming harder every day :-)

Robert

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[Stefan Kangas]

Robert Pluim <rpluim@gmail.com> writes:

> clemera <clemens.radermacher@posteo.de> writes:
>
>>> FWIW, it verifies fine here with Emacs 25.2
>>
>> I tried it again and now it works for me, too. Strange..., what could
>> have caused that it failed before?
>
> There are 'transparent' proxies which will untar archives and then
> retar them, resulting in a file that fails signature verification even
> though the contents are identical. When you then repeat the download,
> the proxy knows it has previously inspected the file, and thus lets
> through the original. Using https solves this issue 99% of the time.
>
> If youʼre using https already, then Iʼm out of ideas :-)

The reporter verified he was indeed using http.  Is there anything
that can or should be done here, or is this to be closed as notabug?

Best regards,
Stefan Kangas

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[Robert Pluim]

>>>>> On Fri, 13 Sep 2019 21:50:27 +0200, Stefan Kangas <stefan@marxist.se> said:

    Stefan> Robert Pluim <rpluim@gmail.com> writes:
    >> clemera <clemens.radermacher@posteo.de> writes:
    >> 
    >>>> FWIW, it verifies fine here with Emacs 25.2
    >>> 
    >>> I tried it again and now it works for me, too. Strange..., what could
    >>> have caused that it failed before?
    >> 
    >> There are 'transparent' proxies which will untar archives and then
    >> retar them, resulting in a file that fails signature verification even
    >> though the contents are identical. When you then repeat the download,
    >> the proxy knows it has previously inspected the file, and thus lets
    >> through the original. Using https solves this issue 99% of the time.
    >> 
    >> If youʼre using https already, then Iʼm out of ideas :-)

    Stefan> The reporter verified he was indeed using http.  Is there anything
    Stefan> that can or should be done here, or is this to be closed as notabug?

I think this is notabug. We can always reopen it if needed.

Robert

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[Stefan Kangas]

Robert Pluim <rpluim@gmail.com> writes:

>     Stefan> The reporter verified he was indeed using http.  Is there anything
>     Stefan> that can or should be done here, or is this to be closed as notabug?
>
> I think this is notabug. We can always reopen it if needed.

Perhaps we could also add something about this issue to PROBLEMS?

How about also adding a recommendation to use https, as far as
possible, for package archives?  I guess that could be added to both
the doc string of package-archives and possibly also the manual.  That
would help security and avoid issues such as these.

Best regards,
Stefan Kangas

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[Robert Pluim]

>>>>> On Mon, 16 Sep 2019 13:04:55 +0200, Stefan Kangas <stefan@marxist.se> said:

    Stefan> Robert Pluim <rpluim@gmail.com> writes:
    Stefan> The reporter verified he was indeed using http.  Is there anything
    Stefan> that can or should be done here, or is this to be closed as notabug?
    >> 
    >> I think this is notabug. We can always reopen it if needed.

    Stefan> Perhaps we could also add something about this issue to PROBLEMS?

Maybe.

    Stefan> How about also adding a recommendation to use https, as far as
    Stefan> possible, for package archives?  I guess that could be added to both
    Stefan> the doc string of package-archives and possibly also the manual.  That
    Stefan> would help security and avoid issues such as these.

This Iʼd be more in favour of.

Robert

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[Eli Zaretskii]

> From: Stefan Kangas <stefan@marxist.se>
> Date: Mon, 16 Sep 2019 13:04:55 +0200
> Cc: 33825@debbugs.gnu.org, clemera <clemens.radermacher@posteo.de>
> 
> > I think this is notabug. We can always reopen it if needed.
> 
> Perhaps we could also add something about this issue to PROBLEMS?

Feel free to do that.

> How about also adding a recommendation to use https, as far as
> possible, for package archives?  I guess that could be added to both
> the doc string of package-archives and possibly also the manual.  That
> would help security and avoid issues such as these.

I'd leave this out of the manual.  Doc string should be enough.

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[Stefan Kangas]

[-- Attachment #1: Type: text/plain, Size: 446 bytes --]

Eli Zaretskii <eliz@gnu.org> writes:

> > How about also adding a recommendation to use https, as far as
> > possible, for package archives?  I guess that could be added to both
> > the doc string of package-archives and possibly also the manual.  That
> > would help security and avoid issues such as these.
>
> I'd leave this out of the manual.  Doc string should be enough.

Thanks.  How about the attached patch?

Best regards,
Stefan Kangas

[-- Attachment #2: 0001-Recommend-https-for-package-archives.patch --]
[-- Type: text/x-patch, Size: 1094 bytes --]

From afc49ccd4e3e593f1f2dfffbdd6e457132efa9cd Mon Sep 17 00:00:00 2001
From: Stefan Kangas <stefankangas@gmail.com>
Date: Mon, 16 Sep 2019 21:09:32 +0200
Subject: [PATCH] Recommend https for package-archives

* lisp/emacs-lisp/package.el (package-archives): Doc fix to recommend
using https sources instead of http where possible.  (Bug#33825)
---
 lisp/emacs-lisp/package.el | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
index ef0c5171de..69c4427e0a 100644
--- a/lisp/emacs-lisp/package.el
+++ b/lisp/emacs-lisp/package.el
@@ -214,7 +214,10 @@ package-archives
   (Other types of URL are currently not supported.)
 
 Only add locations that you trust, since fetching and installing
-a package can run arbitrary code."
+a package can run arbitrary code.
+
+It is advisable to prefer HTTPS URLs over HTTP URLs where
+possible, for improved security and stability."
   :type '(alist :key-type (string :tag "Archive name")
                 :value-type (string :tag "URL or directory name"))
   :risky t
-- 
2.20.1

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[Robert Pluim]

>>>>> On Mon, 16 Sep 2019 21:13:13 +0200, Stefan Kangas <stefan@marxist.se> said:

    Stefan> Eli Zaretskii <eliz@gnu.org> writes:
    >> > How about also adding a recommendation to use https, as far as
    >> > possible, for package archives?  I guess that could be added to both
    >> > the doc string of package-archives and possibly also the manual.  That
    >> > would help security and avoid issues such as these.
    >> 
    >> I'd leave this out of the manual.  Doc string should be enough.

    Stefan> Thanks.  How about the attached patch?

Nits below

    Stefan> Best regards,
    Stefan> Stefan Kangas

    Stefan> From afc49ccd4e3e593f1f2dfffbdd6e457132efa9cd Mon Sep 17 00:00:00 2001
    Stefan> From: Stefan Kangas <stefankangas@gmail.com>
    Stefan> Date: Mon, 16 Sep 2019 21:09:32 +0200
    Stefan> Subject: [PATCH] Recommend https for package-archives

    Stefan> * lisp/emacs-lisp/package.el (package-archives): Doc fix to recommend
    Stefan> using https sources instead of http where possible.
    Stefan> (Bug#33825)

"Recommend using https..." is shorter and more direct.

    Stefan> ---
    Stefan>  lisp/emacs-lisp/package.el | 5 ++++-
    Stefan>  1 file changed, 4 insertions(+), 1 deletion(-)

    Stefan> diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
    Stefan> index ef0c5171de..69c4427e0a 100644
    Stefan> --- a/lisp/emacs-lisp/package.el
    Stefan> +++ b/lisp/emacs-lisp/package.el
    Stefan> @@ -214,7 +214,10 @@ package-archives
    Stefan>    (Other types of URL are currently not supported.)
 
    Stefan>  Only add locations that you trust, since fetching and installing
    Stefan> -a package can run arbitrary code."
    Stefan> +a package can run arbitrary code.
    Stefan> +
    Stefan> +It is advisable to prefer HTTPS URLs over HTTP URLs where
    Stefan> +possible, for improved security and stability."

Similarly: "HTTPS URLs should be used where possible, as they offer
superior security."

"stability" is not really something you can define, so probably better
not to mention it..

Robert

bug#33825: 25.2; , Failing to verify signature for ELPA debbugs package

[Stefan Kangas]

Robert Pluim <rpluim@gmail.com> writes:
> Nits below

Thanks, I've now installed the patch with your suggested changes as
commit f1f2de7cdf.

Since we seem to agree that there is not much else to do here, I'm
also closing this bug.

Best regards,
Stefan Kangas