GNU bug report logs - #22089
installs packages with bad signatures

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 22089 in the body.
You can then email your comments to 22089 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #3 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: submit <at> debbugs.gnu.org
Subject: installs packages with bad signatures
Date: Thu, 03 Dec 2015 18:10:09 -0500

Package: emacs
Version: 25.0.50
Severity: important

Emacs happily installs packages with bad gpg signatures.
This has been flagged by the test-suite and automated builds for the past
several weeks. (I feel like asking why we even have those things, for
all the attention they seem to get.)

This seems to be the first failure.
http://hydra.nixos.org/build/27800227

Here is the diff from the previous build, with several package changes:
http://hydra.nixos.org/api/scmdiff?type=git&rev2=937565268a5dc3377d4c9bff6d48eb3645a77160&rev1=70f1fda4ae6abb5e11dcf281738c25f6f5b06061&uri=git%3A%2F%2Fgit.sv.gnu.org%2Femacs.git&branch=

Here's a standalone recipe in the emacs-25 branch:

cd test/automated
mkdir /tmp/foo
HOME=/tmp/foo ../../src/emacs -Q
(setq package-archives `(("gnu" . ,(expand-file-name "data/package/signed/"))))
(package-import-keyring "data/package/key.pub")
(package-initialize)
(package-refresh-contents)
(package-install 'signed-bad)

M-x list-packages    ->  signed-bad installed

Message #8 received at 22089 <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 22089 <at> debbugs.gnu.org
Subject: Re: bug#22089: installs packages with bad signatures
Date: Fri, 4 Dec 2015 00:14:03 +0000

[Message part 1 (text/plain, inline)]

Thanks for the pointer, Glenn. I clearly messed something up there.

[Message part 2 (text/html, inline)]

Message #11 received at 22089 <at> debbugs.gnu.org (full text, mbox):

From: Michael Albinus <michael.albinus <at> gmx.de>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 22089 <at> debbugs.gnu.org
Subject: Re: bug#22089: installs packages with bad signatures
Date: Fri, 04 Dec 2015 09:12:16 +0100

Glenn Morris <rgm <at> gnu.org> writes:

> Emacs happily installs packages with bad gpg signatures.
> This has been flagged by the test-suite and automated builds for the past
> several weeks. (I feel like asking why we even have those things, for
> all the attention they seem to get.)

Off-topic to this bug, but: hydra status mails to <emacs-buildstatus <at> gnu.org>
have been stopped three months ago. Maybe this could be reactivated;
people (like me) check this list.

Best regards, Michael.

Message #14 received at 22089 <at> debbugs.gnu.org (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: Michael Albinus <michael.albinus <at> gmx.de>
Cc: 22089 <at> debbugs.gnu.org
Subject: Re: bug#22089: installs packages with bad signatures
Date: Fri, 04 Dec 2015 13:42:47 -0500

Michael Albinus wrote:

> Off-topic to this bug, but: hydra status mails to <emacs-buildstatus <at> gnu.org>
> have been stopped three months ago. Maybe this could be reactivated;
> people (like me) check this list.

The place to ask about such things is the hydra-users mailing list.
I've asked about this specific issue several times.
The latest times I asked, I got no reply.
Perhaps they are tired of talking to me (so you could ask instead),
but I assume that for some reason the mail notification feature can't
be fixed and isn't coming back. It's a shame, but personally I just
check the web status page now and then instead.

But if hacking on foo.el, run foo-tests.el (at least) before pushing.
It's not rocket science.
Eg today I see that simple-test is trivially broken by recent changes
in simple.el.

Message #17 received at 22089 <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 22089 <at> debbugs.gnu.org, Michael Albinus <michael.albinus <at> gmx.de>
Subject: Re: bug#22089: installs packages with bad signatures
Date: Sat, 5 Dec 2015 11:35:04 +0000

2015-12-04 18:42 GMT+00:00 Glenn Morris <rgm <at> gnu.org>:
> But if hacking on foo.el, run foo-tests.el (at least) before pushing.
> It's not rocket science.
> Eg today I see that simple-test is trivially broken by recent changes
> in simple.el.


FWIW, I always run the relevant tests before pushing. For some reason,
that specific test is always skipped on my system if I run it with
`make'. That's why I didn't catch that.

Message #20 received at 22089 <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 22089 <at> debbugs.gnu.org, Michael Albinus <michael.albinus <at> gmx.de>
Subject: Re: bug#22089: installs packages with bad signatures
Date: Sat, 5 Dec 2015 19:34:46 +0000

I push a fix for this today. Now waiting for the hydra build to run.
Is this the correct place to look? http://hydra.nixos.org/build/28513720

2015-12-05 11:35 GMT+00:00 Artur Malabarba <bruce.connor.am <at> gmail.com>:
> 2015-12-04 18:42 GMT+00:00 Glenn Morris <rgm <at> gnu.org>:
>> But if hacking on foo.el, run foo-tests.el (at least) before pushing.
>> It's not rocket science.
>> Eg today I see that simple-test is trivially broken by recent changes
>> in simple.el.
>
>
> FWIW, I always run the relevant tests before pushing. For some reason,
> that specific test is always skipped on my system if I run it with
> `make'. That's why I didn't catch that.

Message #23 received at 22089 <at> debbugs.gnu.org (full text, mbox):

From: Michael Albinus <michael.albinus <at> gmx.de>
To: Artur Malabarba <bruce.connor.am <at> gmail.com>
Cc: Glenn Morris <rgm <at> gnu.org>, 22089 <at> debbugs.gnu.org
Subject: Re: bug#22089: installs packages with bad signatures
Date: Sun, 06 Dec 2015 10:01:02 +0100

Artur Malabarba <bruce.connor.am <at> gmail.com> writes:

> I push a fix for this today. Now waiting for the hydra build to run.
> Is this the correct place to look? http://hydra.nixos.org/build/28513720

Not really. Start at <http://hydra.nixos.org/jobset/gnu/emacs-25>. There
you see, that there is still one failing test.

Follow <red 1> -> coverage -> Logfile: raw

At the end of the file, you see that package-test.log does not fail any
longer. If you perform the same exercise with a previous test run,
package-test.log was still mentioned to fail.

Best regards, Michael.

Message #28 received at 22089-done <at> debbugs.gnu.org (full text, mbox):

From: Artur Malabarba <bruce.connor.am <at> gmail.com>
To: Michael Albinus <michael.albinus <at> gmx.de>
Cc: Glenn Morris <rgm <at> gnu.org>, 22089-done <at> debbugs.gnu.org
Subject: Re: bug#22089: installs packages with bad signatures
Date: Sun, 6 Dec 2015 14:01:12 +0000

[Message part 1 (text/plain, inline)]

Ok, thanks Michael.
Closing this then.

[Message part 2 (text/html, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.