GNU bug report logs - #17625
details of package signing mechanism

Previous Next

Package: emacs;

Reported by: Eric Abrahamsen <eric <at> ericabrahamsen.net>

Date: Thu, 29 May 2014 03:12:01 UTC

Severity: important

Tags: security

Found in version 24.4.50

Done: Stefan Monnier <monnier <at> iro.umontreal.ca>

Bug is archived. No further changes may be made.

Full log

Message #134 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Daiki Ueno <ueno <at> gnu.org>
To: bug-gnu-emacs <at> gnu.org
Subject: Re: bug#17625: 24.4.50;
 All installed packages marked "unsigned", no archive listed
Date: Tue, 30 Sep 2014 10:28:18 +0900

Ted Zlatanov <tzz <at> lifelogs.com> writes:

> From the code it seems the EPG glue written by Daiki Ueno expects the
> keyring to live in `(expand-file-name "gnupg" package-user-dir)` which
> implies we have to provide a way, on startup, to populate that keyring
> if it's missing. I don't see any docs or functions to do that. It's not
> terribly complicated, just `gpg --homedir DIRNAME --import KEY` but it
> would be convenient for users if we provide a wrapper.

We already have it, and package-keyring.gpg is automatically imported on
startup.  See package-import-keyring and package-refresh-contents (the
caller).
This bug report was last modified 10 years and 237 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.