bug#35739: Bad signature from GNU ELPA

[Eli Zaretskii]

> From: Stefan Monnier <monnier@iro.umontreal.ca>
> Cc: rcopley@gmail.com,  35739@debbugs.gnu.org,  npostavs@gmail.com
> Date: Thu, 23 May 2019 00:06:19 -0400
> 
> > Where is the decoding happening, then?  According to what you write,
> > URL should just save the files as is, and then decoding should happen
> > when we access the resulting files after saving them.  Is that what
> > happens after the changes?
> 
> That's right.
> 
> > Sorry for the typo: I meant list-packages.  Does that display come
> > from the README files?
> 
> It can come from various places, but the only case affected by my change
> is when it comes from the remote archive in which case it's indeed the
> *-readme.txt file that I do decode explicitly.
> 
> > Other clients might need it in other ways.  From what you explain, it
> > sounds like package.el doesn't need to decode at all when it
> > downloads, so it should disregard the 'charset' header and always
> > treat the stuff it gets as a raw byte stream.  Is that correct?
> 
> That's right.

Sounds good, thanks.

> > If it is correct, then there's no need to make any changes in
> > url*.el routines.
> 
> There is, because the routine that extracts the "raw bytes" is url-insert
> which (until my patch) also did the decoding according to the "charset"
> specified in the HTTP headers returned by the server (if present).
> IOW it didn't always return the raw bytes.

Then how about an optional argument to disable 'charset' handling
instead?  That'd be backward-compatible.

> Note that other clients will only be negatively affected by the change if:
> - the HTTP server has returned a "charset" in its headers.
> - they url-insert into a unibyte buffer.
> - they need the text to be decoded.
> The last two points should be mutually exclusive in sane situations, so
> I think the change is pretty safe.  Or to put it another way, I think
> it's more likely to uncover or even fix a bug than to introduce one.

I'd prefer a backward-compatible change, because that saves us from
the need to be 100% right when estimating the collateral damage,
something that we have failed in several cases in the past.

Thanks.