GNU bug report logs - #17625
details of package signing mechanism

Previous Next

Full log

Message #17 received at 17625 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Monnier <monnier <at> iro.umontreal.ca>
To: Glenn Morris <rgm <at> gnu.org>
Cc: Eric Abrahamsen <eric <at> ericabrahamsen.net>, 17625 <at> debbugs.gnu.org
Subject: Re: bug#17625: 24.4.50;
 All installed packages marked "unsigned", no archive listed
Date: Fri, 30 May 2014 12:28:46 -0400

> The mechanism by which they are supposed to do so seems completely
> undocumented (it's not even mentioned in NEWS), so I have no idea how they
> are expected to do so.

Indeed.  I think there are several bugs here, which we should fix before the
24.4 release:
- the "unsigned" thingy (is this supposed to check the signature of
  installed packages?  How could that work?  I thought we wanted to
  check the signature *during* installation).
- the fact that GNU ELPA's packages aren't signed.
- the fact that the expected signature format is not documented.


        Stefan

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.