49

I just tried to install ascii-art-to-unicode from the gnu repository (http://elpa.gnu.org/) via list-packages. I get the following error:

package--check-signature: Failed to verify signature 
   ascii-art-to-unicode-1.9.el.sig: ("No public key 
   for 474F05837FBDEF9B created at 2014-09-24T16:20:01+0200 
   using DSA")

I'm using cask/pallet to manage my packages; is there some setup I missed? Some recent changes to elpa?

I'm using an emacs 24.4 pre-release.

  • 1
    I had a similar problem today updating org-mode from elpa (though I used package.el). Might be a temporary problem with their servers. – Malabarba Sep 25 '14 at 13:38
40
  1. set package-check-signature to nil, e.g. M-: (setq package-check-signature nil) RET
  2. download the package gnu-elpa-keyring-update and run the function with the same name, e.g. M-x package-install RET gnu-elpa-keyring-update RET.
  3. reset package-check-signature to the default value allow-unsigned

This worked for me.

As stated in the package the following holds:

If your keys are already too old, causing signature verification errors when installing packages, then in order to install this package you can do the following:

  • Fetch the new key manually, e.g. with something like:

    gpg --homedir ~/.emacs.d/elpa/gnupg --receive-keys 066DAFCB81E42C40
    
  • Modify the expiration date of the old key, e.g. with something like:

    gpg --homedir ~/.emacs.d/elpa/gnupg \
        --quick-set-expire 474F05837FBDEF9B 1y
    
  • temporarily disable signature verification (see variable `package-check-signature').

| improve this answer | |
  • 3
    It shouldn't be necessary to explicitly run the function: installing the package should be sufficient because it should run the function for you automatically. – Stefan Oct 14 '19 at 18:31
  • Ahh ok. Hard to test it now that it works, but I think you're right. – joe_maya Oct 14 '19 at 23:43
  • 4
    In case someone else is as confused as me: the command for step 3 is M-: (setq package-check-signature "allow-unsigned") RET with quotations – user2740 Feb 18 at 19:19
  • 2
    When trying to install gnu-elpa-keyring-update, I only get a [no match] message. Could you please help @joe_maya – Leo Aug 27 at 13:18
16

FWIW - I had this issue with the signature org-20140407.tar.sig. Like Sigma's package-check-signature is/was allow-unsigned.

I changed the package-check-signature value to nil and the problem was resolved.

| improve this answer | |
  • Thanks! I would never guess that "allow-unsigned" doesn't mean what it supposed to mean... – avp Sep 23 '19 at 7:59
  • 2
    If you set it to nil, make sure you access the elpa.gnu.org repository via HTTPS, otherwise you're opening yourself to easy security attacks. – Stefan Sep 27 '19 at 14:29
  • @avp: allow-unsigned means that you allow installing packages which don't have signatures. But this package does have a signature (one you can't check because you don't have the needed key in your keyring)! – Stefan Sep 1 at 1:38
14

If you try to install the package gnu-elpa-keyring-update (which seems to have the purpose of updating the keys used by the package manager), you will see in its description that you can do:

gpg --homedir ~/.emacs.d/elpa/gnupg --receive-keys 066DAFCB81E42C40

on the commandline to get new keys manually. To make sure you are asking for the correct key (066DAFCB81E42C40 in the example above), check the error message that emacs gives you when you try to install any package.

| improve this answer | |
5

It appears that the key used to sign this package (474F05837FBDEF9B) is indeed not published (therefore cannot be signed, therefore cannot be trusted). But it would seem that package.el is supposed to fail gracefully (for now) in such cases:

;; If package-check-signature is allow-unsigned, don't
;; signal error when we can't verify signature because of
;; missing public key.  Other errors are still treated as
;; fatal (bug#17625).
(unless (and (eq package-check-signature 'allow-unsigned)
             (eq (epg-signature-status sig) 'no-pubkey))
  (setq had-fatal-error t))

So I'm wondering if for some reason your value of package-check-signature is different than its default value of allow-unsigned ?

| improve this answer | |
  • package-check-signature is allow-unsigned; that leaves the epg-signature-status -- hmm. – Tom Regner Sep 26 '14 at 7:06
  • sig=[cl-struct-epg-signature bad 474F05837FBDEF9B nil nil nil nil nil nil nil nil nil] status=bad - note that the problem is still present. – sds Feb 2 '16 at 19:00
  • allow-unsigned means to allow installation of packages that are not signed, as opposed to packages which are signed but whose signature you're not able to verify. This is used so you can install from ELPA archives which don't sign their packages (MELPA was like that last time I checked). – Stefan Sep 27 '19 at 14:24
3

The answers here are a bit dated. This issue seems to have been fixed as of emacs 26.3.

| improve this answer | |
3

Alternatively, you could upgrade to a newer emacs, e.g. on Ubuntu:

sudo add-apt-repository ppa:ubuntu-elisp/ppa
sudo apt-get update
sudo apt-get install emacs-snapshot

This way you avoid doing all this: https://elpa.gnu.org/packages/gnu-elpa-keyring-update.html

| improve this answer | |
2

get the puglic key with:

gpg2 --homedir ~/.emacs.d/elpa/gnupg --receive-keys 066DAFCB81E42C40

Attention: your version could be a different key !

| improve this answer | |
0

Setting package-check-signature to nil instead of the default allow-unsigned fixed this for me.

Fedora 29, GNU Emacs 26.2 (build 1, x86_64-redhat-linux-gnu, GTK+ Version 3.24.8) of 2019-04-30

| improve this answer | |
0

I get:

 % gpg --homedir ~/.emacs.d/elpa/gnupg --receive-keys 066DAFCB81E42C40
gpg: key 066DAFCB81E42C40: new key but contains no user ID - skipped
gpg: Total number processed: 1
gpg:           w/o user IDs: 1
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.