bug#17625: 24.4.50; All installed packages marked "unsigned", no archive listed

[Stefan Monnier]

SM> Whereas the feature you're discussing seems to be to indicate which
SM> candidates for installation have a signature available for checking
SM> (this is not implemented, AFAICT).
> Is there a plan to implement the latter feature and can I help? I recall
> some discussions months ago but no definite plan.

I see 3 behaviors for it:
- Mention at package-installation time that there's no signature to check,
  maybe with a prompt to confirm the user really wants to go ahead.
  This is more or less the route taken by APT, AFAIK (at least, seen
  from the user's point of view).
- Keep track of which archives have signatures and which don't (e.g. by
  assuming that if `archive-contents' has a sig, then the packages also
  have sigs).  Then somehow display this info in the package list.
- Check each and every package to see if it has a sig.  This implies
  a lot more network communication, AFAICT, so I think it's not
  a good idea.

The first behavior OTOH should be very easy to implement.


        Stefan