SL Baur <steve(a)xemacs.org> writes:
>> Opening file "package-index-1999-05-27" type
text.
>> unknown hash: unable to verify signature
> This is bad. Aren't PGP5 and gpg supposed to be compatible.
I don't know. I assumed he didn't have the key I used to sign the
tarball.
As far as I know, I've never submitted it to a keyserver and
it wasn't on
ftp.xemacs.org until this morning (localtime).
This is all very very very bad. You are in a maze of incompatible PGP
versions all alike. ITAR läst grüssen.
I think it is time for this patch
1999-06-02 Jan Vroonhof <vroonhof(a)math.ethz.ch>
* package-get.el (package-get-require-signed-base-updates):
Default to nil. The current PGP situation is to fragile to do
behind the users back. Sigh..
Index: package-get.el
===================================================================
RCS file: /usr/CVSroot/XEmacs/xemacs-20/lisp/package-get.el,v
retrieving revision 1.27
diff -u -u -r1.27 package-get.el
--- package-get.el 1999/03/10 11:34:11 1.27
+++ package-get.el 1999/06/02 19:44:46
@@ -245,7 +245,7 @@
:type 'boolean
:group 'package-get)
-(defcustom package-get-require-signed-base-updates t
+(defcustom package-get-require-signed-base-updates nil
"*If set to a non-nil value, require explicit user confirmation for updates
to the package-get database which cannot have their signature verified via PGP.
When nil, updates which are not PGP signed are allowed without confirmation."
@@ -404,19 +404,21 @@
(error "Package-get database not updated")))
(if (and content-beg content-end beg end)
(if (not (condition-case nil
- (or (fboundp 'mc-pgp-verify-region)
- (load-library "mc-pgp")
- (fboundp 'mc-pgp-verify-region))
+ (or (boundp 'mc-default-scheme)
+ (load-library "mailcrypt")
+ (boundp 'mc-default-scheme))
(error nil)))
(or (not package-get-require-signed-base-updates)
(yes-or-no-p
"No mailcrypt; can't verify package-get DB signature,
continue? ")
(error "Package-get database not updated"))))
(if (and beg end
- (fboundp 'mc-pgp-verify-region)
+ (boundp 'mc-default-scheme)
(or (not
(condition-case err
- (mc-pgp-verify-region beg end)
+ (funcall (cdr (assoc 'verification-func
+ (funcall mc-default-scheme)))
+ beg end)
(file-error
(and (string-match "No such file" (nth 2 err))
(or (not package-get-require-signed-base-updates)