package manager misuses pgp5, and fails with pgp2.6.2, too
I am running Linux RH5.2 and have RPM "pgp-5.0i-1" installed, which
has been working fine for me in typical message-sending and -receiving
contexts for months under Gnus. In a fresh "xemacs -q", I do
Options -> Manage Packages -> Add Download Site -> xemacs.org
Options -> Manage Packages -> List & Install
An error is thrown on "lstream not open"; the end of my *Message-Log*
buffer contains:
| Retrieving
/anonymous＠ftp.xemacs.org:/pub/xemacs/packages/package-index.LATEST.pgp...done
| Loading mc-pgp...
| Loading mc-pgp...done
| Verifying...
| Package-get PGP signature failed to verify
| Internal error: lstream not open: #<INTERNAL OBJECT (XEmacs bug?) (filedesc lstream)
0x86e73a8>
This in turn is because mailcrypt 3.5.3 (from the latest sumo tarball)
is misusing PGP5, because *Mailcrypt* contains:
PGP is now invoked from different executables for different
operations:
pgpe Encrypt (including Encrypt/Sign)
pgps Sign
pgpv Verify/Decrypt
pgpk Key management
pgpo PGP 2.6.2 command-line simulator (not yet implemented)
See each application's respective man page or the general PGP
documentation
for more information.
When I re-install an old 2.6.2 PGP binary, the results are slightly
different, but no better. Two identical "Error" dialog boxes are
produced to complain about about "Hash: SHA1" and *Message-Log*
complains:
| Loading mc-pgp...
| Loading mc-pgp...done
| Verifying...
| Package-get PGP signature failed to verify
(there is no "internal error" complaint) and *Mailcrypt* reports:
Pretty Good Privacy(tm) 2.6.2 - Public-key encryption for the
masses.
(c) 1990-1994 Philip Zimmermann, Phil's Pretty Good Software. 11 Oct 94
Uses the RSAREF(tm) Toolkit, which is copyright RSA Data Security, Inc.
Distributed by the Massachusetts Institute of Technology.
Export of this software may be restricted by the U.S. government.
Current time: 1999/08/03 17:57 GMT
ERROR: Header line added to ASCII armor: "Hash: SHA1"
ASCII armor corrupted.
Error: Transport armor stripping failed for file pgptemp.$00
For a usage summary, type: pgp -h
For more detailed help, consult the PGP User's Guide.
For the moment, is there a way merely to tell the package manager not
to bother with PGP verifications?
--karl