New commits:
commit 22ec935d18fff85ed141b816da922fd4fc6f3313
Author: Thomas Orgis <sobukus AT sourcemage.org>
Commit: Thomas Orgis <sobukus AT sourcemage.org>
emacs: switch to hash
The signature is broken as they key in the keyring was not updated
recently, but the signature key is different from the past. The
make doing the update probably had the key imported into their private
keyring.
This is one major reason to deprecate use of upstream signatures in
the spell DETAILS. This is too fragile, especially if the signature
file itself is not hashed.
1. Upstream signatures are unsafe, as even a trusted upstream can
re-upload a different file with new signature and change the software
without our builds knowing. We expect to get the upstream tarball the
make who updated the spell used. Plain upstream signatures do not provide
that.
2. Upstream signatures go stale and break do to keys aging and gpg
refusing to check. Perfectly fine software that just happens to have
outlived some signing key fails to cast.
3. GPG Keyrings with upstream keys waste lots of space in the grimoire.
They can become huge.
This volatility is just bad. Please let's agree that the use of
upstream signatures is this:
1. The mage doing the spell update fetches and checks any signatures.
2. Then a secure hash is computed from the source file and recorded
in DETAILS.
3. Maybe we'll have a spell that collects upstream keyrins to ease this
work, not every mage having to track down them each time.
diff --git a/editors/emacs/BB02E407AE9EAA87C9E72A1D2D4E1FE95957135D.gpg
b/editors/emacs/BB02E407AE9EAA87C9E72A1D2D4E1FE95957135D.gpg
deleted file mode 100644
index 94ab42e..0000000
Binary files a/editors/emacs/BB02E407AE9EAA87C9E72A1D2D4E1FE95957135D.gpg and
/dev/null differ
diff --git a/editors/emacs/DETAILS b/editors/emacs/DETAILS
index b3635d7..d1e50e6 100755
--- a/editors/emacs/DETAILS
+++ b/editors/emacs/DETAILS
@@ -12,13 +12,13 @@ else
VERSION=30.2
SECURITY_PATCH=1
SOURCE=${SPELL}-${VERSION}.tar.gz
- SOURCE2=${SOURCE}.sig
+# 1. gpg import https://savannah.gnu.org/project/release-gpgkeys.php?group=emacs&download=1
+# 2. check new ${SOURCE_URL[0]}.sig against this
+# 3. record hash here
+
SOURCE_HASH=sha512:6c3ea9fdb68110ad7b87f7338fbe13bf48a0b7ef2be4d9dae4310e10916458e07d4ec90fcb78aa73094a2e339df7118e2f0026941921b9732a8f4be2f758dc2b
SOURCE_DIRECTORY=${BUILD_DIRECTORY}/${SPELL}-${VERSION:0:4}
SOURCE_URL[0]=${GNU_URL}/${SPELL}/${SOURCE}
SOURCE_URL[1]=ftp://ftp.gnu.org/pub/gnu/${SPELL}/${SOURCE}
- SOURCE2_URL[1]=ftp://ftp.gnu.org/pub/gnu/${SPELL}/${SOURCE2}
-
SOURCE_GPG=BB02E407AE9EAA87C9E72A1D2D4E1FE95957135D.gpg:${SOURCE2}:UPSTREAM_KEY
- SOURCE2_IGNORE=signature
fi
WEB_SITE=http://www.gnu.org/software/emacs
LICENSE[0]=GPL
diff --git a/editors/emacs/HISTORY b/editors/emacs/HISTORY
index 90d2e2d..63f0ef9 100644
--- a/editors/emacs/HISTORY
+++ b/editors/emacs/HISTORY
@@ -1,3 +1,7 @@
+2026-02-13 Thomas Orgis <sobukus AT sourcemage.org>
+ * DETAILS: switch to hash, our keyrings being fragile
+ * BB02E407AE9EAA87C9E72A1D2D4E1FE95957135D.gpg: gone, outdated
+
2025-11-05 Ismael Luceno <ismael AT sourcemage.org>
* DETAILS: updated spell to 30.2
[[SM-Commit] ] GIT changes to master grimoire by Thomas Orgis (22ec935d18fff85ed141b816da922fd4fc6f3313),
Thomas Orgis, 02/13/2026