14

I just tried to install ascii-art-to-unicode from the gnu repository (http://elpa.gnu.org/) via list-packages. I get the following error:

package--check-signature: Failed to verify signature 
   ascii-art-to-unicode-1.9.el.sig: ("No public key 
   for 474F05837FBDEF9B created at 2014-09-24T16:20:01+0200 
   using DSA")

I'm using cask/pallet to manage my packages; is there some setup I missed? Some recent changes to elpa?

I'm using an emacs 24.4 pre-release.

  • 1
    I had a similar problem today updating org-mode from elpa (though I used package.el). Might be a temporary problem with their servers. – Malabarba Sep 25 '14 at 13:38
10

FWIW - I had this issue with the signature org-20140407.tar.sig. Like Sigma's package-check-signature is/was allow-unsigned.

I changed the package-check-signature value to nil and the problem was resolved.

5

It appears that the key used to sign this package (474F05837FBDEF9B) is indeed not published (therefore cannot be signed, therefore cannot be trusted). But it would seem that package.el is supposed to fail gracefully (for now) in such cases:

;; If package-check-signature is allow-unsigned, don't
;; signal error when we can't verify signature because of
;; missing public key.  Other errors are still treated as
;; fatal (bug#17625).
(unless (and (eq package-check-signature 'allow-unsigned)
             (eq (epg-signature-status sig) 'no-pubkey))
  (setq had-fatal-error t))

So I'm wondering if for some reason your value of package-check-signature is different than its default value of allow-unsigned ?

  • package-check-signature is allow-unsigned; that leaves the epg-signature-status -- hmm. – Tom Regner Sep 26 '14 at 7:06
  • sig=[cl-struct-epg-signature bad 474F05837FBDEF9B nil nil nil nil nil nil nil nil nil] status=bad - note that the problem is still present. – sds Feb 2 '16 at 19:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.