Subject: bug#62230: closed (Re: bug#62230: File "elpa-packages.eld" not signed, unlike file "archive-contents")

From: [email-masked] (GNU bug Tracking System)
Date: Sat, 18 Mar 2023 17:29:02 +0000

Your bug report

#62230: File "elpa-packages.eld" not signed, unlike file "archive-contents"

which was filed against the emacs package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
62230: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=62230
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#62230: File "elpa-packages.eld" not signed, unlike file "archive-contents"
From: Philip Kaludercic <[email-masked]>
To: Okamsn <[email-masked]>
Cc: [email-masked], Stefan Monnier <[email-masked]>
Date: Sat, 18 Mar 2023 17:28:36 +0000
List-Id: <debbugs-submit.debbugs.gnu.org>

Okamsn <[email-masked]> writes:

> On 2023-03-18 13:58 UTC, Stefan Monnier wrote:
>>>> It is possible to sign this file with the GNU ELPA key, just like the
>>>> file "archive-contents", which downloads successfully?
>>> It should be, but I actually don't know how it is generated or at least
>>> I am missing something in elpa-admin.el.  I have Cc'ed Stefan who should
>>> know.
>>
>> Yes, that was an oversight  Should be fixed now,
>>
>>
>>          Stefan
>>
>
> The file now downloads successfully. I can see that it also downloaded
> the signatures.
>
> Thank you.

OK, I'll close this report then.  Thanks for noticing.

Subject: File "elpa-packages.eld" not signed, unlike file "archive-contents"
From: Okamsn <[email-masked]>
To: [email-masked], Philip Kaludercic <[email-masked]>
Date: Fri, 17 Mar 2023 00:16:30 +0000
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello,

I have `package-check-signature` set to `all`. When I run the command
`package-vc-install`, it tries to download the file "elpa-package.eld"
from the archive.  However, this file is not signed, so the download fails.

When I disable the checking of signatures, the download succeeds.

It is possible to sign this file with the GNU ELPA key, just like the
file "archive-contents", which downloads successfully?

Thank you.