18

I just tried to install ascii-art-to-unicode from the gnu repository (http://elpa.gnu.org/) via list-packages. I get the following error:

package--check-signature: Failed to verify signature 
   ascii-art-to-unicode-1.9.el.sig: ("No public key 
   for 474F05837FBDEF9B created at 2014-09-24T16:20:01+0200 
   using DSA")

I'm using cask/pallet to manage my packages; is there some setup I missed? Some recent changes to elpa?

I'm using an emacs 24.4 pre-release.

  • 1
    I had a similar problem today updating org-mode from elpa (though I used package.el). Might be a temporary problem with their servers. – Malabarba Sep 25 '14 at 13:38
14

FWIW - I had this issue with the signature org-20140407.tar.sig. Like Sigma's package-check-signature is/was allow-unsigned.

I changed the package-check-signature value to nil and the problem was resolved.

  • Thanks! I would never guess that "allow-unsigned" doesn't mean what it supposed to mean... – avp Sep 23 at 7:59
  • 1
    If you set it to nil, make sure you access the elpa.gnu.org repository via HTTPS, otherwise you're opening yourself to easy security attacks. – Stefan Sep 27 at 14:29
4

It appears that the key used to sign this package (474F05837FBDEF9B) is indeed not published (therefore cannot be signed, therefore cannot be trusted). But it would seem that package.el is supposed to fail gracefully (for now) in such cases:

;; If package-check-signature is allow-unsigned, don't
;; signal error when we can't verify signature because of
;; missing public key.  Other errors are still treated as
;; fatal (bug#17625).
(unless (and (eq package-check-signature 'allow-unsigned)
             (eq (epg-signature-status sig) 'no-pubkey))
  (setq had-fatal-error t))

So I'm wondering if for some reason your value of package-check-signature is different than its default value of allow-unsigned ?

  • package-check-signature is allow-unsigned; that leaves the epg-signature-status -- hmm. – Tom Regner Sep 26 '14 at 7:06
  • sig=[cl-struct-epg-signature bad 474F05837FBDEF9B nil nil nil nil nil nil nil nil nil] status=bad - note that the problem is still present. – sds Feb 2 '16 at 19:00
  • allow-unsigned means to allow installation of packages that are not signed, as opposed to packages which are signed but whose signature you're not able to verify. This is used so you can install from ELPA archives which don't sign their packages (MELPA was like that last time I checked). – Stefan Sep 27 at 14:24
1

1) set package-check-signature to nil 2) download the package gnu-elpa-keyring-update and run the function with the same name. 3) reset package-check-signature to the default value 'allow-unsigned`

This worked for me.

  • It shouldn't be necessary to explicitly run the function: installing the package should be sufficient because it should run the function for you automatically. – Stefan Oct 14 at 18:31
  • Ahh ok. Hard to test it now that it works, but I think you're right. – joe_maya Oct 14 at 23:43
1

Alternatively, you could upgrade to a newer emacs, e.g. on Ubuntu:

sudo add-apt-repository ppa:ubuntu-elisp/ppa
sudo apt-get update
sudo apt-get install emacs-snapshot
0

Setting package-check-signature to nil instead of the default allow-unsigned fixed this for me.

Fedora 29, GNU Emacs 26.2 (build 1, x86_64-redhat-linux-gnu, GTK+ Version 3.24.8) of 2019-04-30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.