From unknown Mon Jun 23 04:12:43 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#35414 <35414@debbugs.gnu.org> To: bug#35414 <35414@debbugs.gnu.org> Subject: Status: 26.2; ELPA packages signed with second, unknown key Reply-To: bug#35414 <35414@debbugs.gnu.org> Date: Mon, 23 Jun 2025 11:12:43 +0000 retitle 35414 26.2; ELPA packages signed with second, unknown key reassign 35414 emacs submitter 35414 Brandon Invergo severity 35414 important tag 35414 security thanks From debbugs-submit-bounces@debbugs.gnu.org Wed Apr 24 08:56:19 2019 Received: (at submit) by debbugs.gnu.org; 24 Apr 2019 12:56:19 +0000 Received: from localhost ([127.0.0.1]:55287 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJHRi-0001K2-K2 for submit@debbugs.gnu.org; Wed, 24 Apr 2019 08:56:19 -0400 Received: from eggs.gnu.org ([209.51.188.92]:60877) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJHRh-0001Jr-CB for submit@debbugs.gnu.org; Wed, 24 Apr 2019 08:56:17 -0400 Received: from lists.gnu.org ([209.51.188.17]:37228) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1hJHRb-0004i5-LD for submit@debbugs.gnu.org; Wed, 24 Apr 2019 08:56:12 -0400 Received: from eggs.gnu.org ([209.51.188.92]:47015) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hJHRa-0001ql-6K for bug-gnu-emacs@gnu.org; Wed, 24 Apr 2019 08:56:11 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,RCVD_IN_DNSWL_NONE, URIBL_BLOCKED autolearn=disabled version=3.3.2 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hJHRY-0004eL-Kc for bug-gnu-emacs@gnu.org; Wed, 24 Apr 2019 08:56:10 -0400 Received: from ostrich.birch.relay.mailchannels.net ([23.83.209.138]:37176) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1hJHRX-0004by-Vh for bug-gnu-emacs@gnu.org; Wed, 24 Apr 2019 08:56:08 -0400 X-Sender-Id: dreamhost|x-authsender|brandon@invergo.net Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id B6A165C50DE for ; Wed, 24 Apr 2019 12:56:03 +0000 (UTC) Received: from pdx1-sub0-mail-a88.g.dreamhost.com (unknown [100.96.28.64]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id 4964B5C4EED for ; Wed, 24 Apr 2019 12:56:03 +0000 (UTC) X-Sender-Id: dreamhost|x-authsender|brandon@invergo.net Received: from pdx1-sub0-mail-a88.g.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384) by 0.0.0.0:2500 (trex/5.17.2); Wed, 24 Apr 2019 12:56:03 +0000 X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|brandon@invergo.net X-MailChannels-Auth-Id: dreamhost X-Daffy-Soft: 1ca46dc44f65af17_1556110563465_3263503172 X-MC-Loop-Signature: 1556110563464:3744401586 X-MC-Ingress-Time: 1556110563464 Received: from pdx1-sub0-mail-a88.g.dreamhost.com (localhost [127.0.0.1]) by pdx1-sub0-mail-a88.g.dreamhost.com (Postfix) with ESMTP id DD7E98089C for ; Wed, 24 Apr 2019 05:56:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=invergo.net; h=from:to :subject:date:message-id:mime-version:content-type; s= invergo.net; bh=Tb0HELWZRIAg6gxsALKhUuBR9g4=; b=W6JeiKyssZ+U4tnZ GVdjb8EPPXKUwv1jmERg7EomnXQ4S9qjRbCQDasTfwvErmNLBnr7VdN8I5Lq1tIF MST07ZWukRPYnz2PtvauDEJIIcdNmNfSjTHnNj3f/Stwv8WDqSeG1laLPSTci0Df JVcrPo+BkdQ2yhceu2qwSt/0Ubk= Received: from localhost (unknown [144.173.111.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: brandon@invergo.net) by pdx1-sub0-mail-a88.g.dreamhost.com (Postfix) with ESMTPSA id 7433C808A1 for ; Wed, 24 Apr 2019 05:56:02 -0700 (PDT) User-agent: mu4e 1.2.0; emacs 26.2 X-DH-BACKEND: pdx1-sub0-mail-a88 From: Brandon Invergo To: bug-gnu-emacs@gnu.org Subject: 26.2; ELPA packages signed with second, unknown key Date: Wed, 24 Apr 2019 13:56:00 +0100 Message-ID: <87mukfsgtb.fsf@invergo.net> MIME-Version: 1.0 Content-Type: text/plain X-VR-OUT-STATUS: OK X-VR-OUT-SCORE: 0 X-VR-OUT-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgeduuddrhedtgdehkecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucggtfgfnhhsuhgsshgtrhhisggvpdfftffgtefojffquffvnecuuegrihhlohhuthemuceftddtnecunecujfgurhepfgfhvffufffkgggtsehttdertddtredtnecuhfhrohhmpeeurhgrnhguohhnucfknhhvvghrghhouceosghrrghnughonhesihhnvhgvrhhgohdrnhgvtheqnecuffhomhgrihhnpehgnhhurdhorhhgnecukfhppedugeegrddujeefrdduuddurdeileenucfrrghrrghmpehmohguvgepshhmthhppdhhvghloheplhhotggrlhhhohhsthdpihhnvghtpedugeegrddujeefrdduuddurdeiledprhgvthhurhhnqdhprghthhepuehrrghnughonhcukfhnvhgvrhhgohcuoegsrhgrnhguohhnsehinhhvvghrghhordhnvghtqedpmhgrihhlfhhrohhmpegsrhgrnhguohhnsehinhhvvghrghhordhnvghtpdhnrhgtphhtthhopegsuhhgqdhgnhhuqdgvmhgrtghssehgnhhurdhorhhgnecuvehluhhsthgvrhfuihiivgeptd X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 23.83.209.138 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: submit X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Hello, I enabled package.el's signature-checking feature last night (variable package-check-signature; Emacs 26.2). I have imported the keyring at etc/package-keyring.gpg, which contains one key: pub dsa2048 2014-09-24 [SC] [expires: 2019-09-23] CA442C00F91774F17F59D9B0474F05837FBDEF9B uid [ unknown] GNU ELPA Signing Agent GNU ELPA is the only repository that has been enabled (https://elpa.gnu.org/packages). When I execute package-refresh-contents or when I try to install a package from ELPA, it fails with the following error: Failed to verify signature archive-contents.sig: No public key for 066DAFCB81E42C40 created at 2019-04-24T10:15:06+0100 using RSA Good signature from 474F05837FBDEF9B GNU ELPA Signing Agent (trust undefined) created at 2019-04-24T10:15:06+0100 using DSA Command output: gpg: Signature made Wed 24 Apr 2019 10:15:06 AM BST gpg: using DSA key CA442C00F91774F17F59D9B0474F05837FBDEF9B gpg: Good signature from "GNU ELPA Signing Agent " [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: CA44 2C00 F917 74F1 7F59 D9B0 474F 0583 7FBD EF9B gpg: Signature made Wed 24 Apr 2019 10:15:06 AM BST gpg: using RSA key C433554766D3DDC64221BFAA066DAFCB81E42C40 gpg: Can't check signature: No public key So, the signature by GNU ELPA Signing Agent (the key in etc/package-keyring.gpg) is fine. However, there is a second key involved, for which the public key 066DAFCB81E42C40 is unavailable from any public keyserver that I have tried. Needless to say, it's not available in etc/package-keyring.gpg either. Since I do not have the public key, the signature verification fails. Just to be sure, I've also done it on a fresh installation-from-source with an init.el that is empty apart from setting up package.el. Same results. I have tried this from outside Emacs, by doing, for example: wget https://elpa.gnu.org/packages/delight-1.5.el{,.sig} gpg2 --verify delight-1.5.el.sig This, of course, gives the same result as doing it from within Emacs. I mention it here to demonstrate that the problem is not in Emacs, from what I can tell, but it is strictly due to this second, unknown key signature. For the extra paranoid, I've tried this on three different systems residing on three different networks in two different countries. I'm pretty sure the problem is on the ELPA server and is a result of the standard signing process. However, we can't 100% rule out user incompetence yet (my own, that is), so I am open to suggestions of what else I might try to pin down the source of the problem. Is the public key 066DAFCB81E42C40 available anywhere? Or have I set up something else incorrectly in the verification process? Or is this second signature there erroneously? Thanks! -- -brandon From debbugs-submit-bounces@debbugs.gnu.org Wed Apr 24 12:03:56 2019 Received: (at control) by debbugs.gnu.org; 24 Apr 2019 16:03:56 +0000 Received: from localhost ([127.0.0.1]:56280 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJKNI-000683-Fi for submit@debbugs.gnu.org; Wed, 24 Apr 2019 12:03:56 -0400 Received: from eggs.gnu.org ([209.51.188.92]:51182) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJKNH-00067g-0s for control@debbugs.gnu.org; Wed, 24 Apr 2019 12:03:55 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:59834) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hJKN9-0002nO-Tq for control@debbugs.gnu.org; Wed, 24 Apr 2019 12:03:47 -0400 Received: from rgm by fencepost.gnu.org with local (Exim 4.82) (envelope-from ) id 1hJKN7-0002fY-AE for control@debbugs.gnu.org; Wed, 24 Apr 2019 12:03:47 -0400 Subject: control message for bug 35414 To: X-Mailer: mail (GNU Mailutils 2.99.98) Message-Id: From: Glenn Morris Date: Wed, 24 Apr 2019 12:03:45 -0400 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) severity 35414 important tag 35414 security From debbugs-submit-bounces@debbugs.gnu.org Wed Apr 24 12:09:10 2019 Received: (at 35414) by debbugs.gnu.org; 24 Apr 2019 16:09:10 +0000 Received: from localhost ([127.0.0.1]:56292 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJKSM-0006GZ-4X for submit@debbugs.gnu.org; Wed, 24 Apr 2019 12:09:10 -0400 Received: from eggs.gnu.org ([209.51.188.92]:52224) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJKSK-0006GM-KO for 35414@debbugs.gnu.org; Wed, 24 Apr 2019 12:09:08 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:59917) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hJKS7-0000je-W4; Wed, 24 Apr 2019 12:08:58 -0400 Received: from rgm by fencepost.gnu.org with local (Exim 4.82) (envelope-from ) id 1hJKS1-0004Rt-Ah; Wed, 24 Apr 2019 12:08:50 -0400 From: Glenn Morris To: Brandon Invergo Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key References: <87mukfsgtb.fsf@invergo.net> Date: Wed, 24 Apr 2019 12:08:48 -0400 In-Reply-To: <87mukfsgtb.fsf@invergo.net> (Brandon Invergo's message of "Wed, 24 Apr 2019 13:56:00 +0100") Message-ID: User-Agent: Gnus (www.gnus.org), GNU Emacs (www.gnu.org/software/emacs/) MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, Stefan Monnier X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) Please forgive the top-posting. I assume (without checking) that this is related to the key from http://lists.gnu.org/r/emacs-diffs/2019-04/msg00546.html Brandon Invergo wrote: > I enabled package.el's signature-checking feature last night (variable > package-check-signature; Emacs 26.2). I have imported the keyring at > etc/package-keyring.gpg, which contains one key: > > pub dsa2048 2014-09-24 [SC] [expires: 2019-09-23] > CA442C00F91774F17F59D9B0474F05837FBDEF9B > uid [ unknown] GNU ELPA Signing Agent > > GNU ELPA is the only repository that has been enabled > (https://elpa.gnu.org/packages). > > When I execute package-refresh-contents or when I try to install a > package from ELPA, it fails with the following error: > > Failed to verify signature archive-contents.sig: > No public key for 066DAFCB81E42C40 created at 2019-04-24T10:15:06+0100 using RSA > Good signature from 474F05837FBDEF9B GNU ELPA Signing Agent (trust undefined) created at 2019-04-24T10:15:06+0100 using DSA > Command output: > gpg: Signature made Wed 24 Apr 2019 10:15:06 AM BST > gpg: using DSA key CA442C00F91774F17F59D9B0474F05837FBDEF9B > gpg: Good signature from "GNU ELPA Signing Agent " [unknown] > gpg: WARNING: This key is not certified with a trusted signature! > gpg: There is no indication that the signature belongs to the owner. > Primary key fingerprint: CA44 2C00 F917 74F1 7F59 D9B0 474F 0583 7FBD EF9B > gpg: Signature made Wed 24 Apr 2019 10:15:06 AM BST > gpg: using RSA key C433554766D3DDC64221BFAA066DAFCB81E42C40 > gpg: Can't check signature: No public key > > So, the signature by GNU ELPA Signing Agent (the key in > etc/package-keyring.gpg) is fine. However, there is a second key > involved, for which the public key 066DAFCB81E42C40 is unavailable from > any public keyserver that I have tried. Needless to say, it's not > available in etc/package-keyring.gpg either. Since I do not have the > public key, the signature verification fails. > > Just to be sure, I've also done it on a fresh installation-from-source > with an init.el that is empty apart from setting up package.el. Same > results. > > I have tried this from outside Emacs, by doing, for example: > > wget https://elpa.gnu.org/packages/delight-1.5.el{,.sig} > gpg2 --verify delight-1.5.el.sig > > This, of course, gives the same result as doing it from within Emacs. I > mention it here to demonstrate that the problem is not in Emacs, from > what I can tell, but it is strictly due to this second, unknown key > signature. > > For the extra paranoid, I've tried this on three different systems > residing on three different networks in two different countries. I'm > pretty sure the problem is on the ELPA server and is a result of the > standard signing process. However, we can't 100% rule out user > incompetence yet (my own, that is), so I am open to suggestions of what > else I might try to pin down the source of the problem. > > Is the public key 066DAFCB81E42C40 available anywhere? Or have I set up > something else incorrectly in the verification process? Or is this > second signature there erroneously? From debbugs-submit-bounces@debbugs.gnu.org Wed Apr 24 15:36:54 2019 Received: (at 35414) by debbugs.gnu.org; 24 Apr 2019 19:36:54 +0000 Received: from localhost ([127.0.0.1]:56543 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJNhO-00071K-5e for submit@debbugs.gnu.org; Wed, 24 Apr 2019 15:36:54 -0400 Received: from chene.dit.umontreal.ca ([132.204.246.20]:58195) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJNhL-00071C-Ty for 35414@debbugs.gnu.org; Wed, 24 Apr 2019 15:36:53 -0400 Received: from pastel.home (lechon.iro.umontreal.ca [132.204.27.242]) by chene.dit.umontreal.ca (8.14.7/8.14.1) with ESMTP id x3OJaoQu008006; Wed, 24 Apr 2019 15:36:50 -0400 Received: by pastel.home (Postfix, from userid 20848) id 1A3D36AE07; Wed, 24 Apr 2019 15:36:50 -0400 (EDT) From: Stefan Monnier To: Glenn Morris Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key Message-ID: References: <87mukfsgtb.fsf@invergo.net> Date: Wed, 24 Apr 2019 15:36:50 -0400 In-Reply-To: (Glenn Morris's message of "Wed, 24 Apr 2019 12:08:48 -0400") User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-NAI-Spam-Flag: NO X-NAI-Spam-Level: X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0.1 X-NAI-Spam-Rules: 3 Rules triggered TRK_NCM1=0.1, EDT_SA_DN_PASS=0, RV6532=0 X-NAI-Spam-Version: 2.3.0.9418 : core <6532> : inlines <7059> : streams <1819617> : uri <2836612> X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, Brandon Invergo X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) > I assume (without checking) that this is related to the key from > http://lists.gnu.org/r/emacs-diffs/2019-04/msg00546.html Hmm... Indeed: this new keyring contains two keys (the old 2014 key which will expire in September and a new key to replace it). >> When I execute package-refresh-contents or when I try to install a >> package from ELPA, it fails with the following error: >> >> Failed to verify signature archive-contents.sig: >> No public key for 066DAFCB81E42C40 created at 2019-04-24T10:15:06+0100 using RSA >> Good signature from 474F05837FBDEF9B GNU ELPA Signing Agent (trust undefined) created at 2019-04-24T10:15:06+0100 using DSA >> Command output: >> gpg: Signature made Wed 24 Apr 2019 10:15:06 AM BST >> gpg: using DSA key CA442C00F91774F17F59D9B0474F05837FBDEF9B >> gpg: Good signature from "GNU ELPA Signing Agent " [unknown] >> gpg: WARNING: This key is not certified with a trusted signature! >> gpg: There is no indication that the signature belongs to the owner. >> Primary key fingerprint: CA44 2C00 F917 74F1 7F59 D9B0 474F 0583 7FBD EF9B >> gpg: Signature made Wed 24 Apr 2019 10:15:06 AM BST >> gpg: using RSA key C433554766D3DDC64221BFAA066DAFCB81E42C40 >> gpg: Can't check signature: No public key Hmm... I just tried with Debian's Emacs-25.1 and with a new build from the `emacs-26` branch: emacs -Q --eval '(setq package-check-signature t) M-x package-list-packages RET M-x package-refresh-contents RET and didn't get any error. >> So, the signature by GNU ELPA Signing Agent (the key in >> etc/package-keyring.gpg) is fine. However, there is a second key >> involved, for which the public key 066DAFCB81E42C40 is unavailable from >> any public keyserver that I have tried. It's a brand new key that is now in etc/package-keyring.gpg in the `master` branch of Emacs, as well as in the `gnu-elpa-keyring-update` package in GNU ELPA. This is because the key 474F05837FBDEF9B is about to expire (it's really high time we start preparing for the new key). >> Needless to say, it's not available in etc/package-keyring.gpg >> either. Since I do not have the public key, the signature >> verification fails. Yes, it's normal that the second signature can't be verified until you install the new key, but that shouldn't cause an error in package-install or package-refresh-contents. At least that's what my tests lead me to believe. Stefan From debbugs-submit-bounces@debbugs.gnu.org Wed Apr 24 18:03:46 2019 Received: (at 35414) by debbugs.gnu.org; 24 Apr 2019 22:03:46 +0000 Received: from localhost ([127.0.0.1]:56680 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJPzW-00022f-EB for submit@debbugs.gnu.org; Wed, 24 Apr 2019 18:03:46 -0400 Received: from orchid.birch.relay.mailchannels.net ([23.83.209.137]:61317) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJPzS-00022V-Uw for 35414@debbugs.gnu.org; Wed, 24 Apr 2019 18:03:43 -0400 X-Sender-Id: dreamhost|x-authsender|brandon@invergo.net Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 3D6CF5E03E8; Wed, 24 Apr 2019 22:03:38 +0000 (UTC) Received: from pdx1-sub0-mail-a45.g.dreamhost.com (100-96-7-81.trex.outbound.svc.cluster.local [100.96.7.81]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id 86CE05E2657; Wed, 24 Apr 2019 22:03:36 +0000 (UTC) X-Sender-Id: dreamhost|x-authsender|brandon@invergo.net Received: from pdx1-sub0-mail-a45.g.dreamhost.com ([TEMPUNAVAIL]. [64.90.62.162]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384) by 0.0.0.0:2500 (trex/5.17.2); Wed, 24 Apr 2019 22:03:38 +0000 X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|brandon@invergo.net X-MailChannels-Auth-Id: dreamhost X-Arch-Skirt: 4ee87fce76f8ad25_1556143417885_2194403274 X-MC-Loop-Signature: 1556143417885:616993006 X-MC-Ingress-Time: 1556143417884 Received: from pdx1-sub0-mail-a45.g.dreamhost.com (localhost [127.0.0.1]) by pdx1-sub0-mail-a45.g.dreamhost.com (Postfix) with ESMTP id DA2737F1FF; Wed, 24 Apr 2019 15:03:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=invergo.net; h=references :from:to:cc:subject:in-reply-to:date:message-id:mime-version :content-type:content-transfer-encoding; s=invergo.net; bh=kUlKW fv8rIPGV77OTMUOR+zrsKQ=; b=K53ZJPI064vOfjlwDDduBo4NkfN0oVS5zmCrw gZjAeD6Sd/1AUORRKONtWXX1xAXlMcpc0hjW5ljjG8wKRvBKC65ciVh1co37tgFr ALfFEszU7DKo0LC4D7EEbfYwcDgrBa8/ET/uN0oahR9vPl/bd5bYz3WCPAYDlHSf 6TDWi4= Received: from localhost (cpc88606-newt36-2-0-cust493.19-3.cable.virginm.net [86.6.93.238]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: brandon@invergo.net) by pdx1-sub0-mail-a45.g.dreamhost.com (Postfix) with ESMTPSA id DAF1F7F1F4; Wed, 24 Apr 2019 15:03:32 -0700 (PDT) References: <87mukfsgtb.fsf@invergo.net> User-agent: mu4e 1.2.0; emacs 26.2 X-DH-BACKEND: pdx1-sub0-mail-a45 From: Brandon Invergo To: Stefan Monnier Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key In-reply-to: Date: Wed, 24 Apr 2019 23:03:29 +0100 Message-ID: <875zr36oy6.fsf@invergo.net> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-VR-OUT-STATUS: OK X-VR-OUT-SCORE: -100 X-VR-OUT-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgeduuddrheefgddtgecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucggtfgfnhhsuhgsshgtrhhisggvpdfftffgtefojffquffvnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjughrpehffgfhvffujgffkfggtgfgsehtqhertddtreejnecuhfhrohhmpeeurhgrnhguohhnucfknhhvvghrghhouceosghrrghnughonhesihhnvhgvrhhgohdrnhgvtheqnecuffhomhgrihhnpehgnhhurdhorhhgnecukfhppeekiedriedrleefrddvfeeknecurfgrrhgrmhepmhhouggvpehsmhhtphdphhgvlhhopehlohgtrghlhhhoshhtpdhinhgvthepkeeirdeirdelfedrvdefkedprhgvthhurhhnqdhprghthhepuehrrghnughonhcukfhnvhgvrhhgohcuoegsrhgrnhguohhnsehinhhvvghrghhordhnvghtqedpmhgrihhlfhhrohhmpegsrhgrnhguohhnsehinhhvvghrghhordhnvghtpdhnrhgtphhtthhopeefheegudegseguvggssghughhsrdhgnhhurdhorhhgnecuvehluhhsthgvrhfuihiivgeptd X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, Glenn Morris X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Stefan Monnier writes: >> I assume (without checking) that this is related to the key from >> http://lists.gnu.org/r/emacs-diffs/2019-04/msg00546.html > > Hmm... Indeed: this new keyring contains two keys (the old 2014 key > which will expire in September and a new key to replace it). I see. Sorry, I only searched the bugs list but not the diffs list! > Hmm... I just tried with Debian's Emacs-25.1 and with a new build from > the `emacs-26` branch: > > emacs -Q --eval '(setq package-check-signature t) > M-x package-list-packages RET > M-x package-refresh-contents RET > > and didn't get any error. I suppose it's worth asking (but apologies if I misunderstand what's happening under the hood): did you perform this test with an empty keyring (or just with what's available in Debian's Emacs-25.1 installation)? I suspect that you already have the new public key in your keyring, so you wouldn't experience the problem. > It's a brand new key that is now in etc/package-keyring.gpg in the > `master` branch of Emacs, as well as in the `gnu-elpa-keyring-update` > package in GNU ELPA. > > This is because the key 474F05837FBDEF9B is about to expire (it's > really high time we start preparing for the new key). OK, that should make things easy enough. Of course, I hadn't seen that package because I was unable to update my archives! Unfortunately, installing the package (after temporarily disabling sig verification) doesn't solve the problem for me. Am I correct to assume that the package should "just work" after installing (and restarting Emacs)? Just for fun I tried manually running gnu-elpa-keyring-update, which resulted in this this: Debugger entered--Lisp error: (error "Can=E2=80=99t find the keyring.gpg fi= le with the new keys") signal(error ("Can=E2=80=99t find the keyring.gpg file with the new keys"= )) error("Can't find the keyring.gpg file with the new keys") gnu-elpa-keyring-update--keyring() gnu-elpa-keyring-update() eval((gnu-elpa-keyring-update) nil) eval-expression((gnu-elpa-keyring-update) nil nil 127) funcall-interactively(eval-expression (gnu-elpa-keyring-update) nil nil 1= 27) call-interactively(eval-expression nil nil) command-execute(eval-expression) gnu-elpa-keyring-update--keyring has the value "etc/gnu-elpa-keyring.gpg", which doesn't exist relative to any relevant paths that I can think of. The files in .emacs.d/elpa/gnupg haven't been modified. I looked at the ELPA git repo and saw that the keyring should be distributed in the etc subdirectory of the package. So I tried manually downloading the keyring from elpa.gnu.org via wget, however I got a 404 error (trying different reasonable URLs). I then manually downloaded it from the ELPA git repository and put it in .emacs.d/elpa/gnu-elpa-keyring-update-2019.0/etc et voila! Success. So, I guess the "bug" at this point is that it would appear that the keyring isn't properly installed with the keyring-update package. I apologize for the original noise, since you obviously had already considered and worked on a fix for the underlying problem. Thanks for your help! -- -brandon From debbugs-submit-bounces@debbugs.gnu.org Wed Apr 24 18:36:34 2019 Received: (at 35414) by debbugs.gnu.org; 24 Apr 2019 22:36:35 +0000 Received: from localhost ([127.0.0.1]:56711 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJQVG-0002pL-Iz for submit@debbugs.gnu.org; Wed, 24 Apr 2019 18:36:34 -0400 Received: from chene.dit.umontreal.ca ([132.204.246.20]:45935) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJQVD-0002pC-OU for 35414@debbugs.gnu.org; Wed, 24 Apr 2019 18:36:32 -0400 Received: from pastel.home (lechon.iro.umontreal.ca [132.204.27.242]) by chene.dit.umontreal.ca (8.14.7/8.14.1) with ESMTP id x3OMaTcc002891; Wed, 24 Apr 2019 18:36:30 -0400 Received: by pastel.home (Postfix, from userid 20848) id CE6E36AE07; Wed, 24 Apr 2019 18:36:29 -0400 (EDT) From: Stefan Monnier To: Brandon Invergo Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key Message-ID: References: <87mukfsgtb.fsf@invergo.net> <875zr36oy6.fsf@invergo.net> Date: Wed, 24 Apr 2019 18:36:29 -0400 In-Reply-To: <875zr36oy6.fsf@invergo.net> (Brandon Invergo's message of "Wed, 24 Apr 2019 23:03:29 +0100") User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-NAI-Spam-Flag: NO X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0 X-NAI-Spam-Rules: 2 Rules triggered EDT_SA_DN_PASS=0, RV6532=0 X-NAI-Spam-Version: 2.3.0.9418 : core <6532> : inlines <7059> : streams <1819629> : uri <2836665> X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, Glenn Morris X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) > I see. Sorry, I only searched the bugs list but not the diffs list! No need to apologize: the new sigs appeared before the keyring was distributed. >> Hmm... I just tried with Debian's Emacs-25.1 and with a new build from >> the `emacs-26` branch: >> >> emacs -Q --eval '(setq package-check-signature t) >> M-x package-list-packages RET >> M-x package-refresh-contents RET >> >> and didn't get any error. > > I suppose it's worth asking (but apologies if I misunderstand what's > happening under the hood): did you perform this test with an empty > keyring (or just with what's available in Debian's Emacs-25.1 > installation)? The keyring was not empty, but only had the 2014 key. > I suspect that you already have the new public key in > your keyring, so you wouldn't experience the problem. I was also afraid of that, so I double checked. >> It's a brand new key that is now in etc/package-keyring.gpg in the >> `master` branch of Emacs, as well as in the `gnu-elpa-keyring-update` >> package in GNU ELPA. >> >> This is because the key 474F05837FBDEF9B is about to expire (it's >> really high time we start preparing for the new key). > > OK, that should make things easy enough. But I don't want for people to have to update their keyring already: they'll need to do that some time before September, but updating your keyring will just hide the problem you're seeing. > Unfortunately, installing the package (after temporarily disabling sig > verification) doesn't solve the problem for me. Am I correct to assume > that the package should "just work" after installing (and restarting > Emacs)? Yes, even without restarting Emacs. > I looked at the ELPA git repo and saw that the keyring should be > distributed in the etc subdirectory of the package. Oh, duh, of course, the scripts decided to make a single-file package out of it, so the keyring is missing. I'll fix that. > So, I guess the "bug" at this point is that it would appear that the > keyring isn't properly installed with the keyring-update package. I > apologize for the original noise, since you obviously had already > considered and worked on a fix for the underlying problem. No, the bug is that the signature verification should not signal an error before September 2019 even if you don't have the new key. Could you remove the gnu-elpa-keyring-update package, and the 2019 key from your keyring and try and help us figure out why you get those errors and I don't? Stefan From debbugs-submit-bounces@debbugs.gnu.org Wed Apr 24 19:02:45 2019 Received: (at 35414) by debbugs.gnu.org; 24 Apr 2019 23:02:45 +0000 Received: from localhost ([127.0.0.1]:56749 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJQuZ-0005WC-NQ for submit@debbugs.gnu.org; Wed, 24 Apr 2019 19:02:45 -0400 Received: from chene.dit.umontreal.ca ([132.204.246.20]:47102) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJQuX-0005W3-Eb for 35414@debbugs.gnu.org; Wed, 24 Apr 2019 19:02:42 -0400 Received: from pastel.home (lechon.iro.umontreal.ca [132.204.27.242]) by chene.dit.umontreal.ca (8.14.7/8.14.1) with ESMTP id x3ON2dI7005699; Wed, 24 Apr 2019 19:02:39 -0400 Received: by pastel.home (Postfix, from userid 20848) id 7234C6AE07; Wed, 24 Apr 2019 19:02:39 -0400 (EDT) From: Stefan Monnier To: Brandon Invergo Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key Message-ID: References: <87mukfsgtb.fsf@invergo.net> <875zr36oy6.fsf@invergo.net> Date: Wed, 24 Apr 2019 19:02:39 -0400 In-Reply-To: (Stefan Monnier's message of "Wed, 24 Apr 2019 18:36:29 -0400") User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-NAI-Spam-Flag: NO X-NAI-Spam-Threshold: 5 X-NAI-Spam-Score: 0 X-NAI-Spam-Rules: 2 Rules triggered EDT_SA_DN_PASS=0, RV6532=0 X-NAI-Spam-Version: 2.3.0.9418 : core <6532> : inlines <7059> : streams <1819631> : uri <2836672> X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, Glenn Morris X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) > No, the bug is that the signature verification should not signal an > error before September 2019 even if you don't have the new key. > > Could you remove the gnu-elpa-keyring-update package, and the 2019 > key from your keyring and try and help us figure out why you get > those errors and I don't? Oh, wait, I see it now: I had set package-check-signature incorrectly. So, I can reproduce the problem now with (setq package-check-signature t) It works correctly if you've set it to the default `allow-unsigned`. I think it's a mistake: `allow-unsigned` should mean to allow installing packages when they don't have a signature at all, and `t` should mean to allow installing if at least one of the sigs is verified rather than only if all the sigs are verified. But that ship has sailed, so I'm going to have to rethink the transition to the new key. Damn! Stefan From debbugs-submit-bounces@debbugs.gnu.org Wed Apr 24 19:07:40 2019 Received: (at 35414) by debbugs.gnu.org; 24 Apr 2019 23:07:40 +0000 Received: from localhost ([127.0.0.1]:56758 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJQzM-0005dE-0Z for submit@debbugs.gnu.org; Wed, 24 Apr 2019 19:07:40 -0400 Received: from eggs.gnu.org ([209.51.188.92]:54080) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJQzK-0005d1-FY for 35414@debbugs.gnu.org; Wed, 24 Apr 2019 19:07:38 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:39219) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hJQzF-0005dA-AG; Wed, 24 Apr 2019 19:07:33 -0400 Received: from rgm by fencepost.gnu.org with local (Exim 4.82) (envelope-from ) id 1hJQzD-00079F-Px; Wed, 24 Apr 2019 19:07:31 -0400 From: Glenn Morris To: Stefan Monnier Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key References: <87mukfsgtb.fsf@invergo.net> <875zr36oy6.fsf@invergo.net> X-Spook: enemy of the state South Africa Vickie Weaver Taiwan X-Ran: K>~?BJu1[y+@xkkLf(|entg?WeWq,JiB*z>Q(Ugq?N_&v"<|=+;;^Foh,]Jjg2Wgd X-Hue: cyan X-Debbugs-No-Ack: yes X-Attribution: GM Date: Wed, 24 Apr 2019 19:07:31 -0400 In-Reply-To: (Stefan Monnier's message of "Wed, 24 Apr 2019 19:02:39 -0400") Message-ID: <76a7gfvw7g.fsf@fencepost.gnu.org> User-Agent: Gnus (www.gnus.org), GNU Emacs (www.gnu.org/software/emacs/) MIME-Version: 1.0 Content-Type: text/plain X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, Brandon Invergo X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) BTW I imagine 26f9a77 should be in the emacs-26 branch. (Although no announcement has been made about the future of that branch AFAIK.) From debbugs-submit-bounces@debbugs.gnu.org Thu Apr 25 02:23:45 2019 Received: (at 35414) by debbugs.gnu.org; 25 Apr 2019 06:23:45 +0000 Received: from localhost ([127.0.0.1]:57268 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJXnM-0007ix-Mt for submit@debbugs.gnu.org; Thu, 25 Apr 2019 02:23:44 -0400 Received: from eggs.gnu.org ([209.51.188.92]:43548) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJXnK-0007ik-P7 for 35414@debbugs.gnu.org; Thu, 25 Apr 2019 02:23:43 -0400 Received: from fencepost.gnu.org ([2001:470:142:3::e]:45382) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1hJXnF-0001tc-3x; Thu, 25 Apr 2019 02:23:37 -0400 Received: from [176.228.60.248] (port=1890 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1hJXnE-0003LW-7z; Thu, 25 Apr 2019 02:23:36 -0400 Date: Thu, 25 Apr 2019 09:23:17 +0300 Message-Id: <838svy1u3u.fsf@gnu.org> From: Eli Zaretskii To: Glenn Morris In-reply-to: <76a7gfvw7g.fsf@fencepost.gnu.org> (message from Glenn Morris on Wed, 24 Apr 2019 19:07:31 -0400) Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key References: <87mukfsgtb.fsf@invergo.net> <875zr36oy6.fsf@invergo.net> <76a7gfvw7g.fsf@fencepost.gnu.org> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, brandon@invergo.net, monnier@IRO.UMontreal.CA X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) > From: Glenn Morris > Date: Wed, 24 Apr 2019 19:07:31 -0400 > Cc: 35414@debbugs.gnu.org, Brandon Invergo > > > BTW I imagine 26f9a77 should be in the emacs-26 branch. Fine with me, thanks. From debbugs-submit-bounces@debbugs.gnu.org Thu Apr 25 04:39:06 2019 Received: (at 35414) by debbugs.gnu.org; 25 Apr 2019 08:39:06 +0000 Received: from localhost ([127.0.0.1]:57383 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJZuL-0002Rc-Vx for submit@debbugs.gnu.org; Thu, 25 Apr 2019 04:39:06 -0400 Received: from pdx1-sub0-mail-fallback-a1.dreamhost.com ([64.90.62.138]:47626) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hJZuK-0002R9-B0 for 35414@debbugs.gnu.org; Thu, 25 Apr 2019 04:39:04 -0400 Received: from pdx1-sub0-mail-a57.g.dreamhost.com (unknown [10.35.43.53]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pdx1-sub0-mail-fallback-a1.dreamhost.com (Postfix) with ESMTPS id 41B9F278219; Thu, 25 Apr 2019 01:38:57 -0700 (PDT) Received: from pdx1-sub0-mail-a57.g.dreamhost.com (localhost [127.0.0.1]) by pdx1-sub0-mail-a57.g.dreamhost.com (Postfix) with ESMTP id 56D0B7F09F; Thu, 25 Apr 2019 01:36:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=invergo.net; h=references :from:to:cc:subject:in-reply-to:date:message-id:mime-version :content-type; s=invergo.net; bh=KVmVoklEBGjkHWsk90s421N/ARA=; b= crxMaecbSU/qxBKen6vKZe9dmxcHZVkPKjZznVrIYkB2UH2ed5sd3QYKdHHSPHgW 9lSZgYZUhy03AOujApyvCIQN31aa0sOrny3bl9Wx7SXvhFFRaEkGYSa2UHndBwmp +l3XQkbFnBZiGUHnmjgXqXadZ3kA8aIYBw6vU81iOpQ= Received: from localhost (unknown [144.173.111.69]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: brandon@invergo.net) by pdx1-sub0-mail-a57.g.dreamhost.com (Postfix) with ESMTPSA id 52FDC7F0A7; Thu, 25 Apr 2019 01:36:47 -0700 (PDT) References: <87mukfsgtb.fsf@invergo.net> <875zr36oy6.fsf@invergo.net> User-agent: mu4e 1.2.0; emacs 26.2 X-DH-BACKEND: pdx1-sub0-mail-a57 From: Brandon Invergo To: Stefan Monnier Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key In-reply-to: Date: Thu, 25 Apr 2019 09:36:45 +0100 Message-ID: <87lfzyscpu.fsf@invergo.net> MIME-Version: 1.0 Content-Type: text/plain X-VR-OUT-STATUS: OK X-VR-OUT-SCORE: -100 X-VR-OUT-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrgeduuddrheeggddtgecutefuodetggdotefrodftvfcurfhrohhfihhlvgemucggtfgfnhhsuhgsshgtrhhisggvpdfftffgtefojffquffvnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnthhsucdlqddutddtmdenucfjughrpehffgfhvffujgffkfggtgesthdtredttdertdenucfhrhhomhepuehrrghnughonhcukfhnvhgvrhhgohcuoegsrhgrnhguohhnsehinhhvvghrghhordhnvghtqeenucfkphepudeggedrudejfedrudduuddrieelnecurfgrrhgrmhepmhhouggvpehsmhhtphdphhgvlhhopehlohgtrghlhhhoshhtpdhinhgvthepudeggedrudejfedrudduuddrieelpdhrvghtuhhrnhdqphgrthhhpeeurhgrnhguohhnucfknhhvvghrghhouceosghrrghnughonhesihhnvhgvrhhgohdrnhgvtheqpdhmrghilhhfrhhomhepsghrrghnughonhesihhnvhgvrhhgohdrnhgvthdpnhhrtghpthhtohepfeehgedugeesuggvsggsuhhgshdrghhnuhdrohhrghenucevlhhushhtvghrufhiiigvpedt X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, Glenn Morris X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Stefan Monnier writes: > But that ship has sailed, so I'm going to have to rethink the transition > to the new key. Damn! At this point, it might just suffice to spread the word far and wide that people using ELPA package verification need to 1) disable verification, 2) install the transition package, and then 3) re-enable verification. A few well-placed announcements should directly reach a substantial portion of ELPA users, while also potentially getting the info indexed in search engines for more people to find when they get affected. All that said, I'm not an expert but an alternative strategy for the future might be to extend the life of the original key (gpg --edit-key), send it to a keyserver (gpg --send-keys), and then write an "package-update-keyring" procedure that pulls updated public keys from the keyserver (equivalent to gpg --recv-keys). Of course, that doesn't help the people who are not running the latest release that features the update procedure, so a transitional package on ELPA that provides it would still be necessary. -- -brandon From debbugs-submit-bounces@debbugs.gnu.org Sat May 04 08:22:01 2019 Received: (at control) by debbugs.gnu.org; 4 May 2019 12:22:01 +0000 Received: from localhost ([127.0.0.1]:50506 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hMtg0-00080B-Pk for submit@debbugs.gnu.org; Sat, 04 May 2019 08:22:01 -0400 Received: from mail-qk1-f177.google.com ([209.85.222.177]:37370) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hMtfy-0007zr-C3; Sat, 04 May 2019 08:21:59 -0400 Received: by mail-qk1-f177.google.com with SMTP id c1so587008qkk.4; Sat, 04 May 2019 05:21:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:references:date:in-reply-to:message-id :user-agent:mime-version; bh=g3ubJavrTtRpI3Tq+J89JvHUNOO7Kk0aTv5oRpVhCKo=; b=im74K/wKLJAG9Q2klCclNPtnsOicUfR5wtHjbhx0ma7aY8jkMXLHxIf1bZjsPDA9Xv 8VZNn6elkoMm4BNtsU4Vp9AIHF7EBKX8q8FTtNbZrTrn5YN7hqm2TddHFAj9IE8FPwMq jDTC7fpFk5dA2Um+AWnTpKvHQqWAVX59jTjTuKVf0y6M70qUgHhueNLBRVTH1RIuJaE0 yT3nXxCJRhhOZNuaJNsE1pm8NmtSNjLs9zF8ph+t+58bFOsifpvCQUbey5w8tVrZOo5z wNt73dnQH+BkMiaY/4jW849vYYeio9PflOUbv7+IT/lZI23EQNJNvFgMkBU883QZBM8N jnzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:references:date:in-reply-to :message-id:user-agent:mime-version; bh=g3ubJavrTtRpI3Tq+J89JvHUNOO7Kk0aTv5oRpVhCKo=; b=NRgZ0H4JtKOx9n49I0OznT2eheA+BTARXEBcPvrWQ7261xKpwP2rEnobZKkpFSEGWg J//JwhZpXWWUpa/1lOfhYI+Fs0ikGYq7/R5b7bGhNmzexNfcbzL5kT3A3fP8nZVcXRkr I26LVghSh3k3BkyjnHIBIfoO0Rtxb3/eLOQH5iPfkyTd9Dsi3O3FqoRMlbjse+NMxc4i 2HQh0OFzHy5D8DTpc5Zx0Nxbzh3jPJAMmRpDP3BMH2ZaFtXQDaFalqu6/HxwaRtkBpCj 5oeIVzzXP2f/HN4oemS66QuEYBqBlkermtckvTduL510G5TBkpbflWCgSACM4CYGYNZG LSgw== X-Gm-Message-State: APjAAAW1qIxfTG+W2TToD7hVxB8cNOx05KFBjmtZZROvft9Wj3LtV16n +LFW+qkjp2pboIpeVEFRDBAKiDTI X-Google-Smtp-Source: APXvYqwggVuucpt9d3hp7jhNKI6SiQQBEBhaSl7afGje/QU0pZWdrT+V/QsIZzLy0RWlaa7O9qKnyA== X-Received: by 2002:a05:620a:15e3:: with SMTP id p3mr12207446qkm.211.1556972512656; Sat, 04 May 2019 05:21:52 -0700 (PDT) Received: from minid (cbl-45-2-119-34.yyz.frontiernetworks.ca. [45.2.119.34]) by smtp.googlemail.com with ESMTPSA id v20sm1720751qtj.0.2019.05.04.05.21.51 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Sat, 04 May 2019 05:21:51 -0700 (PDT) From: Noam Postavsky To: Michael Chapman Subject: Re: bug#35534: 26.2; Failure to verify signature archive-contents.sig References: Date: Sat, 04 May 2019 08:21:50 -0400 In-Reply-To: (Michael Chapman's message of "Thu, 02 May 2019 09:25:46 +0200") Message-ID: <8736luo1ep.fsf@gmail.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.2 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: control Cc: 35534@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) forcemerge 35414 35534 quit Michael Chapman writes: > Failed to verify signature archive-contents.sig: > Bad signature from 474F05837FBDEF9B GNU ELPA Signing Agent > gpg: BAD signature from "GNU ELPA Signing Agent > " [unknown] > Some further details of the context are available at > https://www.reddit.com/r/emacs/comments/bgdq2n/failure_to_install_auctex_on_emacs_with_package/ > There I was advised this is a bug and should be reported. It was meanwhile reported as https://debbugs.gnu.org/35414. From debbugs-submit-bounces@debbugs.gnu.org Wed May 08 13:20:59 2019 Received: (at 35414) by debbugs.gnu.org; 8 May 2019 17:20:59 +0000 Received: from localhost ([127.0.0.1]:33933 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hOQFX-00075R-9R for submit@debbugs.gnu.org; Wed, 08 May 2019 13:20:59 -0400 Received: from mail01.iro.umontreal.ca ([132.204.25.201]:41948) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1hOQFV-00075E-D7 for 35414@debbugs.gnu.org; Wed, 08 May 2019 13:20:57 -0400 Received: from mail01.iro.umontreal.ca (mail01.iro.umontreal.ca [127.0.0.1]) by mail01.iro.umontreal.ca (Postfix) with ESMTP id 39CD78940A45 for <35414@debbugs.gnu.org>; Wed, 8 May 2019 13:20:52 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=iro.umontreal.ca; h=content-type:content-type:mime-version:user-agent:in-reply-to :date:date:references:message-id:subject:subject:to:from:from; s=dkim; t=1557336051; x=1558200052; bh=Xizi8hxDdceD0BTzqn8guNy/ W4hldXi6vsxsYQ/p8FA=; b=WuF/8u2Ror0SV8mneG1XyaJiiKBFSrN6iCQpdypc UlBoxu9jQU8mX460WjoEV/Z5ZjzMa9xziQms7oen/lZPAu0an1XYXnZh9+Kpn4Ia RtDxauLJMsg7NhzBMg1JOnSChSVYcgP2wdxpYL7Iylp657vhMZHZJorA0/e04ud4 tL/J3kPYFVp/cbxpLzkoBD6PUrs7V9mVgeBM0p64mj9gEprHZ88Tmjnk0ErXOcyI M3Ib6WMPDrbbQN9an+QvDEuy/FchOB61NVB0X7APOnbxGG4LfL+PsZQXUUau1jgE WQ9WWKFYk9i2/bnUbvOxcVJ7gvu3dJxynHC65EMGbiNCmg== X-Virus-Scanned: amavisd-new at iro.umontreal.ca Received: from mail01.iro.umontreal.ca ([127.0.0.1]) by mail01.iro.umontreal.ca (mail01.iro.umontreal.ca [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6HGH_bRvwpSS for <35414@debbugs.gnu.org>; Wed, 8 May 2019 13:20:51 -0400 (EDT) Received: from alfajor (modemcable213.149-175-137.mc.videotron.ca [137.175.149.213]) by mail01.iro.umontreal.ca (Postfix) with ESMTPSA id 39C8C8940A2E; Wed, 8 May 2019 13:20:51 -0400 (EDT) From: Stefan Monnier To: Glenn Morris Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key Message-ID: References: <87mukfsgtb.fsf@invergo.net> <875zr36oy6.fsf@invergo.net> <76a7gfvw7g.fsf@fencepost.gnu.org> Date: Wed, 08 May 2019 13:20:50 -0400 In-Reply-To: <76a7gfvw7g.fsf@fencepost.gnu.org> (Glenn Morris's message of "Wed, 24 Apr 2019 19:07:31 -0400") User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, Brandon Invergo X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) > BTW I imagine 26f9a77 should be in the emacs-26 branch. > (Although no announcement has been made about the future of that > branch AFAIK.) I wasn't 100% sure that it was safe, so I wanted to give it some exposure in `master` first. But yes, I just pushed that change to emacs-26. Stefan From debbugs-submit-bounces@debbugs.gnu.org Mon Sep 30 18:03:07 2019 Received: (at 35414) by debbugs.gnu.org; 30 Sep 2019 22:03:07 +0000 Received: from localhost ([127.0.0.1]:60688 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1iF3l5-0003ZM-F7 for submit@debbugs.gnu.org; Mon, 30 Sep 2019 18:03:07 -0400 Received: from mail-pg1-f194.google.com ([209.85.215.194]:36637) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1iF3l4-0003Yp-3a for 35414@debbugs.gnu.org; Mon, 30 Sep 2019 18:03:06 -0400 Received: by mail-pg1-f194.google.com with SMTP id t14so8136587pgs.3 for <35414@debbugs.gnu.org>; Mon, 30 Sep 2019 15:03:06 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=qRhCeonjlBVDSTu72xp+rzJeN+gMbaXIoYKwzBz6ris=; b=ddlFWcxLnHo3MnPkpykIjrF+qpvuCOcWKwAldbZQ7fYYRhuaQoD0JkkQkqBVeHOKdE aO4uzgBwydrSzqDmyQnZDIxothSFVSofoieEwZ4MOeC6P79XCVnCqhuGlBAGZTT/CL0L /UnVMj5dV805iPU1gufOnvSxQtfu0a9F7LhthjCuswhNRFVBtTmNql2vqiB7dHzsy04C Ca/cJNG24IhmzI0obClqwKDSshyWA4XvvXuI8OvkgMVrpxU3NJJjg1g5+c7N4JxYvK5o mgIbi2RAwgR4FbleVqyjXEdBEhbKx5MidH+ylsFHOEM5Be6cUKXYKo1jqpD4Kj96fsqv qd8A== X-Gm-Message-State: APjAAAV0UlqikiISOrgBY/zENeA+NtAdfg1jlVhrv5mKKSuKGXFytoEq 3y8CgY6F13R2fKFfeeZjVEZq9Uj4adZbQn5q5qIOZcC1+V4= X-Google-Smtp-Source: APXvYqxNGi7BHqvvZX6fMZxXb6fTHBRa6hJjOJkMmtGfGag2p0vsg1t8o7NVKmsVwvtWVTArWMvIpF703OXci2mRkX4= X-Received: by 2002:a63:720f:: with SMTP id n15mr25500810pgc.198.1569880980449; Mon, 30 Sep 2019 15:03:00 -0700 (PDT) MIME-Version: 1.0 From: Stefan Kangas Date: Tue, 1 Oct 2019 00:02:49 +0200 Message-ID: Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key To: Stefan Monnier Content-Type: text/plain; charset="UTF-8" X-Spam-Score: 0.3 (/) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, Glenn Morris , Brandon Invergo X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.7 (/) Stefan Monnier writes: >> No, the bug is that the signature verification should not signal an >> error before September 2019 even if you don't have the new key. >> >> Could you remove the gnu-elpa-keyring-update package, and the 2019 >> key from your keyring and try and help us figure out why you get >> those errors and I don't? > > Oh, wait, I see it now: I had set package-check-signature incorrectly. > So, I can reproduce the problem now with > > (setq package-check-signature t) > > It works correctly if you've set it to the default `allow-unsigned`. > > I think it's a mistake: `allow-unsigned` should mean to allow installing > packages when they don't have a signature at all, and `t` should mean > to allow installing if at least one of the sigs is verified rather than > only if all the sigs are verified. > > But that ship has sailed, so I'm going to have to rethink the transition > to the new key. Damn! What's the status on this? Anything else that needs doing before 27.1? Best regards, Stefan Kangas From debbugs-submit-bounces@debbugs.gnu.org Mon Sep 30 19:27:56 2019 Received: (at 35414) by debbugs.gnu.org; 30 Sep 2019 23:27:56 +0000 Received: from localhost ([127.0.0.1]:60701 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1iF55A-0007mE-0q for submit@debbugs.gnu.org; Mon, 30 Sep 2019 19:27:56 -0400 Received: from mailscanner.iro.umontreal.ca ([132.204.25.50]:1715) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1iF557-0007ly-MX for 35414@debbugs.gnu.org; Mon, 30 Sep 2019 19:27:54 -0400 Received: from pmg2.iro.umontreal.ca (localhost.localdomain [127.0.0.1]) by pmg2.iro.umontreal.ca (Proxmox) with ESMTP id 3250284E36; Mon, 30 Sep 2019 19:27:48 -0400 (EDT) Received: from mail01.iro.umontreal.ca (unknown [172.31.2.1]) by pmg2.iro.umontreal.ca (Proxmox) with ESMTP id A2100811C2; Mon, 30 Sep 2019 19:27:46 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=iro.umontreal.ca; s=mail; t=1569886066; bh=PjKnsbc/a0SKmJG51/Pl40WkH7qgiPXcNXiwRoOcWdQ=; h=From:To:Cc:Subject:References:Date:In-Reply-To:From; b=GaiyE0qvaW2BHOwQII9XVAdalQdjNToX59oIazDPEPQzwmU+D3Sf+LEvUmwAcZ8FS Dz81odUB1T/UNJqULXHw9eQI9SnvA7HV9knl3AHB6inYF4fEUc5hRijahKs+Oh+MkN kcPl4siACwePfSdak91kGVW6T5tkC4T2t+vRQq/unaCxW9U/mVNyxjVVXbWQ6juWaG guNEQh2Q9F2UeeZz/bTbWHs/APnd4v4G5ykFVEhk46Pug3GF7CHBUXuci1N5UsC8ju Z71eQBapZR2mn5VOXDMJhWLkmDE4PkmrgRLNF7ObD7mHutF6/HcgBqkfUISIoKkB9d VLVbJrgERtAMw== Received: from alfajor (107-179-151-143.cpe.teksavvy.com [107.179.151.143]) by mail01.iro.umontreal.ca (Postfix) with ESMTPSA id 4AFC7120775; Mon, 30 Sep 2019 19:27:46 -0400 (EDT) From: Stefan Monnier To: Stefan Kangas Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key Message-ID: References: Date: Mon, 30 Sep 2019 19:27:38 -0400 In-Reply-To: (Stefan Kangas's message of "Tue, 1 Oct 2019 00:02:49 +0200") User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.0.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-SPAM-INFO: Spam detection results: 0 ALL_TRUSTED -1 Passed through trusted hosts only via SMTP AWL -0.238 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain X-SPAM-LEVEL: X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, Glenn Morris , Brandon Invergo X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) > What's the status on this? Anything else that needs doing before 27.1? No, it's ready for 27.1. Stefan From debbugs-submit-bounces@debbugs.gnu.org Sat Jan 25 12:12:50 2020 Received: (at 35414) by debbugs.gnu.org; 25 Jan 2020 17:12:50 +0000 Received: from localhost ([127.0.0.1]:56272 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ivOzJ-000288-Qv for submit@debbugs.gnu.org; Sat, 25 Jan 2020 12:12:50 -0500 Received: from ted.gofardesign.uk ([67.225.143.91]:44642) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ivOzI-00027w-RK for 35414@debbugs.gnu.org; Sat, 25 Jan 2020 12:12:49 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=marxist.se; s=default; h=Content-Type:MIME-Version:Message-ID:Date:References: In-Reply-To:Subject:Cc:To:From:Sender:Reply-To:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=89yqPnTSGZlrVPZXF10yAGgQfLaJuHfITrhHVaqixMk=; b=D4HHX0CH8FwsZhbWkq/VgN0Sm8 /IVJeKG3XjBNvi0rZTbyqED9onhZnQ0AVJA7NWFm3Qs9xWeN0POY6IQsU6d317Ew0IxVDyMyWHBVL HT9XuWmU6XTmdi1Ihw7CKwXn9OEXdC1btG+CT6Icen7Bej+XlowmNirUfoVpvXZVCHvxRPgp1lvc7 05LicNIR+9VZ7U2+6eaHpdj7YB1zOX2qeikNHCo8KG0wNkB3y2u5e3iEmTMpAANbLbQZPRvEMLx9p EyIvWBdkE2VHIInR/unQYiXqa3Genn9FP81TuBpqa08pyiwXduUgkbgg3NljTJN3DqSEIOqQEkzhW kGTrRiBA==; Received: from h-70-69.a785.priv.bahnhof.se ([155.4.70.69]:56452 helo=localhost) by ted.gofardesign.uk with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.92) (envelope-from ) id 1ivOzC-000fKo-Qv; Sat, 25 Jan 2020 12:12:43 -0500 From: Stefan Kangas To: Stefan Monnier Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key In-Reply-To: (Stefan Monnier's message of "Mon, 30 Sep 2019 19:27:38 -0400") References: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.0.50 (gnu/linux) Date: Sat, 25 Jan 2020 18:12:41 +0100 Message-ID: <87imkz794m.fsf@marxist.se> MIME-Version: 1.0 Content-Type: text/plain X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - ted.gofardesign.uk X-AntiAbuse: Original Domain - debbugs.gnu.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - marxist.se X-Get-Message-Sender-Via: ted.gofardesign.uk: authenticated_id: stefan@marxist.se X-Authenticated-Sender: ted.gofardesign.uk: stefan@marxist.se X-Source: X-Source-Args: X-Source-Dir: X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 35414 Cc: 35414@debbugs.gnu.org, Glenn Morris , Brandon Invergo X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Stefan Monnier writes: >> What's the status on this? Anything else that needs doing before 27.1? > > No, it's ready for 27.1. Is there anything more to do here, or should this bug be closed? Best regards, Stefan Kangas From debbugs-submit-bounces@debbugs.gnu.org Sat Jan 25 12:31:35 2020 Received: (at 35414-done) by debbugs.gnu.org; 25 Jan 2020 17:31:36 +0000 Received: from localhost ([127.0.0.1]:56281 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ivPHT-0004Zp-MV for submit@debbugs.gnu.org; Sat, 25 Jan 2020 12:31:35 -0500 Received: from mailscanner.iro.umontreal.ca ([132.204.25.50]:18443) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1ivPHS-0004Zc-5i for 35414-done@debbugs.gnu.org; Sat, 25 Jan 2020 12:31:34 -0500 Received: from pmg3.iro.umontreal.ca (localhost [127.0.0.1]) by pmg3.iro.umontreal.ca (Proxmox) with ESMTP id C3C874409D1; Sat, 25 Jan 2020 12:31:28 -0500 (EST) Received: from mail01.iro.umontreal.ca (unknown [172.31.2.1]) by pmg3.iro.umontreal.ca (Proxmox) with ESMTP id 7C8084409C0; Sat, 25 Jan 2020 12:31:23 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=iro.umontreal.ca; s=mail; t=1579973483; bh=Cxv57ZVzj8pLkefxEzvGsY4VuYJ7YinQN5aPX+w5Lvo=; h=From:To:Cc:Subject:References:Date:In-Reply-To:From; b=UVbQ8pXQvsv4T/bfSiv49YsE4QaIfDrN5DZoEEmt2PdKgprdkTQCxmWZmETwoN6l1 YlWRFd3hUqSZrCgFBElbraOGx2uraUB0D0COi9fTAACp1fyafDkhU1RAWmYBsMOmKw 3OEFiU/xjhGfI51aWKUS0FSuQuPWh2RhGLKFpn4llcybkQlo/hOny4BgH5zx2wDitH Y/Q1dlnwLl2rfgHOUKLrvmJdIYYr47N6JQYv75uaVUZ9uSzX0qjWt7nCKjSEGs6C4s ZR6f22ULo164IKKExiYKHIA+tXZSWHfI7z2Xp8IyEZYlWA4/pMnUk5c3b1rncvQOV0 Uz5KLPNuq8IdA== Received: from pastel (69-196-141-61.dsl.teksavvy.com [69.196.141.61]) by mail01.iro.umontreal.ca (Postfix) with ESMTPSA id 2EF42120B04; Sat, 25 Jan 2020 12:31:23 -0500 (EST) From: Stefan Monnier To: Stefan Kangas Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key Message-ID: References: <87imkz794m.fsf@marxist.se> Date: Sat, 25 Jan 2020 12:31:21 -0500 In-Reply-To: <87imkz794m.fsf@marxist.se> (Stefan Kangas's message of "Sat, 25 Jan 2020 18:12:41 +0100") User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.0.50 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain X-SPAM-INFO: Spam detection results: 0 ALL_TRUSTED -1 Passed through trusted hosts only via SMTP AWL 0.036 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain X-SPAM-LEVEL: X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 35414-done Cc: 35414-done@debbugs.gnu.org, Glenn Morris , Brandon Invergo X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) > Is there anything more to do here, or should this bug be closed? Done, thanks, Stefan From unknown Mon Jun 23 04:12:43 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Sun, 23 Feb 2020 12:24:03 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator From debbugs-submit-bounces@debbugs.gnu.org Mon Dec 07 04:59:29 2020 Received: (at control) by debbugs.gnu.org; 7 Dec 2020 09:59:29 +0000 Received: from localhost ([127.0.0.1]:52459 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kmDIm-0005VL-Tw for submit@debbugs.gnu.org; Mon, 07 Dec 2020 04:59:29 -0500 Received: from mail-pj1-f41.google.com ([209.85.216.41]:53363) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1kmDIh-0005Uq-PP for control@debbugs.gnu.org; Mon, 07 Dec 2020 04:59:25 -0500 Received: by mail-pj1-f41.google.com with SMTP id iq13so7058024pjb.3 for ; Mon, 07 Dec 2020 01:59:23 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=7/0BRv/fixXWrzhV1qDAqu30G8hxHWZSNSBSsSECbaU=; b=MgmOV9p61WeSAgEUrTdl9BWgee0g72ivyQKmJC6aTPo/KEGVKQAkXqrP4tkMXxhHc/ ZlJcgU9OU9yAWElXluHgf2Fum2bkDJeRN+dFpkdGVsE0nCuXIroSiZxgOPIiW3elMJlW s/kzOh+4SrOZrfR15Md/JHfwfvuXHu+uO68mrDqKlFa2TA4mPblZfcEQVCfBj1sgUYmh WiDrlXca2UDJoAaDRP0Lp+8UsYmHjzVulWGEY7vZ11uBuFKJXSoH9h5gwY58Hodp2I2I hSMdR0j8BOqueGdYYELz28Hgg5q3UtvLm86Y4COa4hlASs/2+ELR80+97lL+n5ybanju ovnA== X-Gm-Message-State: AOAM533ge2yYL4A+8/TD96qc7ZPeH1cxPmBIdb/kFoY1OHwqWZdInuUV iaLKzoda0Vz2ILNlH6mvEZCwDBL7FnO8hQvnd76I2hctZ5ihfQ== X-Google-Smtp-Source: ABdhPJyr2nDorxtyvPo4Lc6JHULXsocDijzGtfZplKJ5m8XzBUPw6oMnK71ATJKYSN0xiiirIE30O+0Xk+tkRAMCdQo= X-Received: by 2002:a17:90a:fb43:: with SMTP id iq3mr16170002pjb.175.1607335157730; Mon, 07 Dec 2020 01:59:17 -0800 (PST) MIME-Version: 1.0 References: <27AB811F-5851-4C73-BC5C-CA7E6620DEB9@yrl.co.uk> <33515FB5-D870-45B0-93A5-E321C9FA702D@yrl.co.uk> In-Reply-To: <33515FB5-D870-45B0-93A5-E321C9FA702D@yrl.co.uk> From: Stefan Kangas Date: Mon, 7 Dec 2020 10:59:06 +0100 Message-ID: Subject: Re: bug#44907: 25.3.50; elpa auctex will not update or delete To: Elliott Roper Content-Type: text/plain; charset="UTF-8" Bcc: control@debbugs.gnu.org X-Spam-Score: 0.5 (/) X-Debbugs-Envelope-To: control Cc: 44907-done@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.5 (/) unarchive 35414 forcemerge 35414 44907 thanks Elliott Roper writes: > Thanks. That worked perfectly. Great, I'm therefore closing this bug. [[For some reason, I have been unable to unarchive Bug#35414 to merge these two bugs. Trying again with this message.]] From unknown Mon Jun 23 04:12:43 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Mon, 04 Jan 2021 12:24:03 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator