bug#35739: Bad signature from GNU ELPA

[Stefan Monnier]

> I don't think I understand the change enough to say something
> intelligent here.  The commit explains, o some extent, why the
> original code failed, but it says nothing about the way the new code
> solves the problem without introducing new ones.

It solves the problem by refraining from decoding until we know
positively that it needs to happen.  In the patch I installed, I only
end up decoding the readme.txt descriptions.  Maybe there are other
places where decoding is needed, if so we'll need to fix those cases
I missed when we find them.

> I'm also mildly worried about the incompatible change in url-insert,
> which is a general-purpose function not limited to package.el and its
> signature verification.

Yes, this part should definitely not be in emacs-26.

Luckily, I think the rest of the change still solves our problem in
practice in Emacs-26 (the change in url-insert only affects the case
where the HTTP headers returned by the server specify a particular
"charset", which is not the case when downloading .tar and .el files
from elpa.gnu.org AFAICT).


        Stefan