bug#35739: Bad signature from GNU ELPA

[Stefan Monnier]

> Where is the decoding happening, then?  According to what you write,
> URL should just save the files as is, and then decoding should happen
> when we access the resulting files after saving them.  Is that what
> happens after the changes?

That's right.

> Sorry for the typo: I meant list-packages.  Does that display come
> from the README files?

It can come from various places, but the only case affected by my change
is when it comes from the remote archive in which case it's indeed the
*-readme.txt file that I do decode explicitly.

> Other clients might need it in other ways.  From what you explain, it
> sounds like package.el doesn't need to decode at all when it
> downloads, so it should disregard the 'charset' header and always
> treat the stuff it gets as a raw byte stream.  Is that correct?

That's right.

> If it is correct, then there's no need to make any changes in
> url*.el routines.

There is, because the routine that extracts the "raw bytes" is url-insert
which (until my patch) also did the decoding according to the "charset"
specified in the HTTP headers returned by the server (if present).
IOW it didn't always return the raw bytes.

Note that other clients will only be negatively affected by the change if:
- the HTTP server has returned a "charset" in its headers.
- they url-insert into a unibyte buffer.
- they need the text to be decoded.
The last two points should be mutually exclusive in sane situations, so
I think the change is pretty safe.  Or to put it another way, I think
it's more likely to uncover or even fix a bug than to introduce one.


        Stefan