bug#17625: 24.4.50; All installed packages marked "unsigned", no archive listed

[Glenn Morris]

Stefan Monnier wrote:

> I could try if someone tells me what I need to do.

Something like this:

Make a test package on elpa.gnu.org (don't use a real one for the reason
I mentioned about people currently not being able to install it without
the key). Maybe do both a single-file one and a multi-file one.

Generate a gpg key using gpg --gen-key.
For testing, accepting all the defaults seems fine.

Later we should think whether/when the key should expire, and whose
name/email it should use (eg yours, or a generic elpa.gnu.org one). We
also need to think about how to store the key passphrase, if things are
to be signed automatically.

Use that key to sign the test packages:

 gpg -ba -o FILE.sig FILE

where FILE = foo.el or foo.tar

Put FILE.sig in the same place as FILE on the server.

Export the public part of the key you just generated:
gpg --armor --export email@example.com > foo.key

I think that's it for the server.

On the client, try to install that package from Emacs.
It should fail until you import the public key using
M-x package-import-keyring.