GNU bug report logs - #35414
26.2; ELPA packages signed with second, unknown key

Previous Next

Full log

Message #15 received at 35414 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Monnier <monnier <at> IRO.UMontreal.CA>
To: Glenn Morris <rgm <at> gnu.org>
Cc: 35414 <at> debbugs.gnu.org, Brandon Invergo <brandon <at> invergo.net>
Subject: Re: bug#35414: 26.2; ELPA packages signed with second, unknown key
Date: Wed, 24 Apr 2019 15:36:50 -0400

> I assume (without checking) that this is related to the key from
> http://lists.gnu.org/r/emacs-diffs/2019-04/msg00546.html

Hmm... Indeed: this new keyring contains two keys (the old 2014 key
which will expire in September and a new key to replace it).

>> When I execute package-refresh-contents or when I try to install a
>> package from ELPA, it fails with the following error:
>>
>>     Failed to verify signature archive-contents.sig:
>>     No public key for 066DAFCB81E42C40 created at 2019-04-24T10:15:06+0100 using RSA
>>     Good signature from 474F05837FBDEF9B GNU ELPA Signing Agent <elpasign <at> elpa.gnu.org> (trust undefined) created at 2019-04-24T10:15:06+0100 using DSA
>>     Command output:
>>     gpg: Signature made Wed 24 Apr 2019 10:15:06 AM BST
>>     gpg:                using DSA key CA442C00F91774F17F59D9B0474F05837FBDEF9B
>>     gpg: Good signature from "GNU ELPA Signing Agent <elpasign <at> elpa.gnu.org>" [unknown]
>>     gpg: WARNING: This key is not certified with a trusted signature!
>>     gpg:          There is no indication that the signature belongs to the owner.
>>     Primary key fingerprint: CA44 2C00 F917 74F1 7F59  D9B0 474F 0583 7FBD EF9B
>>     gpg: Signature made Wed 24 Apr 2019 10:15:06 AM BST
>>     gpg:                using RSA key C433554766D3DDC64221BFAA066DAFCB81E42C40
>>     gpg: Can't check signature: No public key

Hmm... I just tried with Debian's Emacs-25.1 and with a new build from
the `emacs-26` branch:

    emacs -Q --eval '(setq package-check-signature t)
    M-x package-list-packages RET
    M-x package-refresh-contents RET

and didn't get any error.

>> So, the signature by GNU ELPA Signing Agent (the key in
>> etc/package-keyring.gpg) is fine.  However, there is a second key
>> involved, for which the public key 066DAFCB81E42C40 is unavailable from
>> any public keyserver that I have tried.

It's a brand new key that is now in etc/package-keyring.gpg in the
`master` branch of Emacs, as well as in the `gnu-elpa-keyring-update`
package in GNU ELPA.

This is because the key 474F05837FBDEF9B is about to expire (it's
really high time we start preparing for the new key).

>> Needless to say, it's not available in etc/package-keyring.gpg
>> either.  Since I do not have the public key, the signature
>> verification fails.

Yes, it's normal that the second signature can't be verified until you
install the new key, but that shouldn't cause an error in
package-install or package-refresh-contents.  At least that's what my
tests lead me to believe.


        Stefan

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.