GNU bug report logs - #17625
details of package signing mechanism

Previous Next

Full log

View this message in rfc822 format

From: Ted Zlatanov <tzz <at> lifelogs.com>
To: Stefan Monnier <monnier <at> iro.umontreal.ca>, Daiki Ueno <ueno <at> unixuser.org>
Cc: 17625 <at> debbugs.gnu.org
Subject: bug#17625: 24.4.50; All installed packages marked "unsigned", no archive listed
Date: Wed, 01 Oct 2014 19:13:51 -0400

My test report from the emacs-24 branch:

Everything worked smoothly with GnuPG 1.x installed (install signed
package load-dir from the GNU ELPA; fail unsigned package
typing-practice from marmalade). It was a very nice experience! I didn't
try corrupting archive-contents or package contents.

When I intentionally broke GnuPG (made /usr/bin/gpg a copy of
/bin/false) the errors were reasonable.

The homedir, defaulting to `/home/tzz/.emacs.d/elpa/gnupg' in my case,
was created with 755 permissions and GnuPG rightly complained:

gpg: WARNING: unsafe permissions on homedir `/home/tzz/.emacs.d/elpa/gnupg'

I didn't make the necessary change but it's trivial.

I would make `package-check-signature' a radio instead of a dropdown
choice, since there are only three possibilities and it's nice to see
them all at once.  Otherwise the user has to click on the dropdown to
see them.

I hope that's helpful. I can make the two changes suggested above if you
wish. I also feel it is very reasonable to set `package-check-signature'
to t (if GnuPG is installed) in the next release, because the experience
is so seamless.  But at least for myself, I'm happily setting it to t now.

I think it would be nice for new users to explain a little more about
this new feature and process in packages.texi or in the main manual.

Thanks for your patience
Ted

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.