From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!.POSTED.blaine.gmane.org!not-for-mail From: Richard Copley Newsgroups: gmane.emacs.bugs Subject: bug#35739: Bad signature from GNU ELPA Date: Wed, 15 May 2019 16:12:35 +0100 Message-ID: References: <87mujog0ao.fsf@gmail.com> <837easa178.fsf@gnu.org> <8336lfaii7.fsf@gnu.org> Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="000000000000e83fc40588ee950b" Injection-Info: blaine.gmane.org; posting-host="blaine.gmane.org:195.159.176.226"; logging-data="84183"; mail-complaints-to="usenet@blaine.gmane.org" Cc: 35739@debbugs.gnu.org, Noam Postavsky To: Eli Zaretskii Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Wed May 15 17:23:53 2019 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([209.51.188.17]) by blaine.gmane.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:256) (Exim 4.89) (envelope-from ) id 1hQvl2-000Ln3-Bz for geb-bug-gnu-emacs@m.gmane.org; Wed, 15 May 2019 17:23:52 +0200 Original-Received: from localhost ([127.0.0.1]:38591 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hQvl1-0002Rg-0r for geb-bug-gnu-emacs@m.gmane.org; Wed, 15 May 2019 11:23:51 -0400 Original-Received: from eggs.gnu.org ([209.51.188.92]:44042) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hQvkm-0002GT-Pd for bug-gnu-emacs@gnu.org; Wed, 15 May 2019 11:23:38 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hQvbW-0004O8-5f for bug-gnu-emacs@gnu.org; Wed, 15 May 2019 11:14:03 -0400 Original-Received: from debbugs.gnu.org ([209.51.188.43]:39640) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1hQvbW-0004Nl-2j for bug-gnu-emacs@gnu.org; Wed, 15 May 2019 11:14:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1hQvbV-0007ZV-RQ for bug-gnu-emacs@gnu.org; Wed, 15 May 2019 11:14:01 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Richard Copley Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Wed, 15 May 2019 15:14:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 35739 X-GNU-PR-Package: emacs Original-Received: via spool by 35739-submit@debbugs.gnu.org id=B35739.155793319129042 (code B ref 35739); Wed, 15 May 2019 15:14:01 +0000 Original-Received: (at 35739) by debbugs.gnu.org; 15 May 2019 15:13:11 +0000 Original-Received: from localhost ([127.0.0.1]:53184 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hQvag-0007YM-Op for submit@debbugs.gnu.org; Wed, 15 May 2019 11:13:11 -0400 Original-Received: from mail-oi1-f174.google.com ([209.85.167.174]:46046) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hQvae-0007Y8-A4 for 35739@debbugs.gnu.org; Wed, 15 May 2019 11:13:08 -0400 Original-Received: by mail-oi1-f174.google.com with SMTP id w144so2072648oie.12 for <35739@debbugs.gnu.org>; Wed, 15 May 2019 08:13:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=r6PQGBPvAuWRrq+gP9LpMHgjqk63Mk4UNxgJvrFWYFM=; b=Y7QXRsY5hvRa5lLYXBbNobPFk5BtbdtMOwy+I6zsvXEDQpNeVFE6bp8GO/JXmLZgwW kcPtPy4ik86iPvcN33jPXkrpWHuJC+XswPgv1+Fxdc7+bda2cAx2h3/Y2pdOUYS03jcb x99bUdts/gRpO9aAvfN+jdGUYjS4w2STow4mybibb30kNMVs9kCuk/LnD0sayerCq4xh O6PSUNRZTjmF/YRzGtRF67CLRksKouWZRykdEA/hRnmNm0X4m0n+QMI/GBjY8ygx/7pT psEj8NFhHAsXV8DE/a/WRP9/B8S6wZom4r/SHpGqnqz7Dzk3eBwfkTlBgHT72iWVcv4i 4ZVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=r6PQGBPvAuWRrq+gP9LpMHgjqk63Mk4UNxgJvrFWYFM=; b=EEoGW+R99SgoP5JyWHSTKZbVUPuemrHDNGAUEL3jOSVOgc9QwGxPVOJQlNx8KmTsUo BUh88DFPUluBFElXhSLkMS5wc66KogvACpEGullP5U1cCw0WB6/FC1uI1S/0UU8q7CRA tY8MTI9H3VYHemXtSU+6jPOzNg1wDMGkA0g8In5UGbthqAGbcRgDot2VXHSmorU1R0GR a0SWrSmGz8v+UUsTsgzP6Ve2qgJi/f2Ck/mhkmVSx1gCxgPHf0G/fGBWIZCzLfbixFgJ J29iii7ImozZ2wtnrP2xFEd+qa8/+LxfudZdDllQqVxEwMFAyt9GjYzZ5VMxFGuIF0mh g00Q== X-Gm-Message-State: APjAAAXSgN858kRy4UY1iLm2wZT64uUrK/785XsIIuPE+OhjNtF6YWf/ 0L/bl0S930sQKV4fwi1B3twNCvGwfKblfvk+DFM= X-Google-Smtp-Source: APXvYqwGPAkhluPC+7mn87at5Jfqf+zQ64OTYXG3xp08llfGlF9btD3UBxpCOInDVAbYZYdcMFKWw/vxmqCXNL2kBNI= X-Received: by 2002:aca:4fd3:: with SMTP id d202mr6721973oib.153.1557933182171; Wed, 15 May 2019 08:13:02 -0700 (PDT) In-Reply-To: <8336lfaii7.fsf@gnu.org> X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.51.188.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.org gmane.emacs.bugs:159345 Archived-At: --000000000000e83fc40588ee950b Content-Type: text/plain; charset="UTF-8" On Wed, 15 May 2019, 15:40 Eli Zaretskii, wrote: > > From: Richard Copley > > Date: Wed, 15 May 2019 07:46:12 +0100 > > Cc: Noam Postavsky , 35739@debbugs.gnu.org > > > > I don't see how disabling decoding could make sense, can you explain? > > > > Not in detail, it's not an area of expertise of mine. We call > > (decode-coding-region (point-min) (point-max) 'undecided) on the > > payload of "https://elpa.gnu.org/packages/archive-contents", > > which is raw text. The resulting buffer's buffer-file-coding- > > system is iso-latin-1-dos. > > > > > > What does this code do on GNU/Linux? > > > > The same. The resulting coding system is iso-latin-1-unix. > > That URL seems to bring ASCII text. Are you saying that GPG produces > a wrong signature because EOL format is significant for it? (Please > forgive silly questions about GPG: I seldom if ever use it.) > Getting the signature involves applying a hash function to the bytes in question. It's desirable that two different byte sequences give rise to two different signatures, even if the difference is a carriage return. In any case, if we don't want EOL conversion, we should bind > inhibit-eol-conversion to a non-nil value, and change nothing else. > But this should not be done in url-insert-buffer-contents, it should > be done in package.el, because the former is a general utility and not > necessarily needs to inhibit EOL conversion for all of its callers. > Of course. I was confirming Noam's hunch, not suggesting a change. Sorry that wasn't clear. --000000000000e83fc40588ee950b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable

On Wed, 15 May 2019,= 15:40 Eli Zaretskii, <eliz@gnu.org> wrote:
> From: Richard Copley <= rcopley@gmail.com>
> Date: Wed, 15 May 2019 07:46:12 +0100
> Cc: Noam Postavsky <npostavs@gmail.com>= ;, 35739@debbugs.gnu.org
>
>=C2=A0 I don't see how disabling decoding could make sense, can you= explain?
>
> Not in detail, it's not an area of expertise of mine. We call
> (decode-coding-region (point-min) (point-max) 'undecided) on the > payload of "https://elpa.gnu.org/packages/archive-contents",
> which is raw text. The resulting buffer's buffer-file-coding-
> system is iso-latin-1-dos.
>=C2=A0
>
>=C2=A0 What does this code do on GNU/Linux?
>
> The same. The resulting coding system is iso-latin-1-unix.

That URL seems to bring ASCII text.=C2=A0 Are you saying that GPG produces<= br> a wrong signature because EOL format is significant for it?=C2=A0 (Please forgive silly questions about GPG: I seldom if ever use it.)

Getting the signature involves app= lying a hash function to the bytes
in question. It's desirabl= e that two different byte sequences give rise
to two different si= gnatures, even if the difference is a carriage return.

In any case, if we don't want EOL conversion, we should bind
inhibit-eol-conversion to a non-nil value, and change nothing else.
But this should not be done in url-insert-buffer-contents, it should
be done in package.el, because the former is a general utility and not
necessarily needs to inhibit EOL conversion for all of its callers.

Of course. I w= as confirming Noam's hunch, not suggesting a change.
Sorry th= at wasn't clear.

--000000000000e83fc40588ee950b--