Re: bug in handling of package-unsigned-archives

[Andy Moreton]

Ping!

On Mon 20 Feb 2017, Andy Moreton wrote:

> Consider the following package archive setup:
>
> (setq package-archives '(("melpa" . "https://melpa.org/packages/";)
>                          ("gnu"   . "https://elpa.gnu.org/packages/";)))
> (setq package-check-signature   t)
> (setq package-unsigned-archives '("melpa"))
>
> Using "M-x list-packages" results in an error being reported: "Unsigned
> file ‘archive-contents’ at https://melpa.org/packages/";. This is caused
> by an incorrect check in package.el - the following patch fixes it.
>
> 2017-02-20  Andy Moreton  <address@hidden>
>
>       Fix check for package-unsigned-archives during retrieval.
>
>       * lisp/emacs-lisp/package.el (package--download-one-archive):
>           Fix check for package-unsigned-archives.
>
> diff --git a/lisp/emacs-lisp/package.el b/lisp/emacs-lisp/package.el
> index 6728f1b..13b8051 100644
> --- a/lisp/emacs-lisp/package.el
> +++ b/lisp/emacs-lisp/package.el
> @@ -1522,7 +1522,7 @@ package--download-one-archive
>        (when (listp (read-from-string content))
>          (make-directory dir t)
>          (if (or (not package-check-signature)
> -                (member archive package-unsigned-archives))
> +                (member name package-unsigned-archives))
>              ;; If we don't care about the signature, save the file and
>              ;; we're done.
>              (progn (write-region content nil local-file nil 'silent)