GNU bug report logs - #21314
24.5; Missing documentation for `package-unsigned-archives' variable

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 21314 in the body.
You can then email your comments to 21314 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: nljlistbox2 <at> gmail.com (N. Jackson)
To: bug-gnu-emacs <at> gnu.org
Subject: 24.5; Missing documentation for `package-unsigned-archives' variable
Date: Fri, 21 Aug 2015 13:12:24 -0300

The functionality in package.el has been working well for me with Gnu
ELPA for some time. My configuration was this:

    (package-initialize)
    (setq package-check-signature t)

I decided to try out navi-mode from Melpa Stable. Following the
instructions at Melpa [1], my configuration became:

    (package-initialize)
    (setq package-check-signature t)
    (add-to-list 'package-archives
                 '("melpa-stable" . "http://stable.melpa.org/packages/") t)

However, Melpa Stable does not appear to be a signed archive. (No
mention of signing is made on the Melpa site, as far as I could see.)
M-x list-packages RET with this configuration gives the rather
uninformative error message:

    Failed to download `melpa-stable' archive.

(Perhaps this error message could be more detailed?)

Setting debug-on-error, I see this:

    Debugger entered--Lisp error: (error "Unsigned archive `melpa-stable'")
      signal(error ("Unsigned archive `melpa-stable'"))
      error("Unsigned archive `%s'" "melpa-stable")
      package--download-one-archive(("melpa-stable" . "https://stable.melpa.org/packages/") "archive-contents")

As a workaround, I tried:

    (package-initialize)
    (setq package-check-signature nil)
    (add-to-list 'package-archives
                 '("melpa-stable" . "http://stable.melpa.org/packages/") t)

This _does_ work, but I don't want to turn off the checking of
signatures for all archives.

In (info "(emacs) Package Installation"), I read:

    If you use some archives that do not sign their packages, you can add
    them to the list ‘package-unsigned-archives’.

This sounds promising, but it is the only mention of
`package-unsigned-archives' in the manual. (At least, there is just the
one entry in the index.) And the docstring only says:

    List of archives where we do not check for package signatures.

The documentation fails to describe what representation of the archive
must be added to this list. Just its name? It's URL? A symbol
representing the archive? A reference to some object representing the
archive? I tried the following:

    (package-initialize)
    (setq package-check-signature t)
    (add-to-list 'package-archives
                 '("melpa-stable" . "http://stable.melpa.org/packages/") t)
    (add-to-list 'package-unsigned-archives '"melpa-stable")

And also:

    (add-to-list 'package-unsigned-archives '("melpa-stable"))
    (setq package-unsigned-archives (quote ("melpa-stable")))

But in all three cases, I get the same error as I do when I don't try to
set this variable.

FWIW I also get the error with Emacs -Q:

    $ emacs -Q
    M-x package-initialize RET
    M-: (setq package-check-signature t) RET
    M-: (add-to-list 'package-archives '("melpa-stable" . "http://stable.melpa.org/packages/") t) RET
    M-: (add-to-list 'package-unsigned-archives '"melpa-stable") RET
    M-: (setq debug-on-error t) RET
    M-x list-packages RET

Please document the correct way to use the `package-unsigned-archives'
variable.

Thanks.

[1] http://stable.melpa.org/#/getting-started.



In GNU Emacs 24.5.1 (x86_64-unknown-linux-gnu, GTK+ Version 3.14.15)
 of 2015-08-18 on moondust
Windowing system distributor `Fedora Project', version 11.0.11603000
System Description:	Fedora release 21 (Twenty One)

Configured using:
 `configure --prefix=/home/nlj/local/ --enable-checking=yes,glyphs
 'CFLAGS=-O0 -g3 -ggdb''

Message #8 received at 21314 <at> debbugs.gnu.org (full text, mbox):

From: Lars Ingebrigtsen <larsi <at> gnus.org>
To: nljlistbox2 <at> gmail.com (N. Jackson)
Cc: 21314 <at> debbugs.gnu.org
Subject: Re: bug#21314: 24.5; Missing documentation for
 `package-unsigned-archives' variable
Date: Sat, 12 Oct 2019 21:28:05 +0200

nljlistbox2 <at> gmail.com (N. Jackson) writes:

> This sounds promising, but it is the only mention of
> `package-unsigned-archives' in the manual. (At least, there is just the
> one entry in the index.) And the docstring only says:
>
>     List of archives where we do not check for package signatures.
>
> The documentation fails to describe what representation of the archive
> must be added to this list. Just its name? It's URL? A symbol
> representing the archive? A reference to some object representing the
> archive? I tried the following:

It looks like this has been fixed since this bug was filed, so I'm
closing this bug report:

---
List of archives where we do not check for package signatures.
This should be a list of strings matching the names of package
archives in the variable ‘package-archives’.
---


-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.