Re: Unable to use `package-refresh-contents`: Bad signature from GNU ELPA Signing Agent

[Nicky Chorley]

On Sat, 22 Jun 2019 at 14:04, VanL <van@scratch.space> wrote:

> May be you need to locate your gpg program and put it in .emacs like
>
> (setq epg-gpg-program "/usr/local/bin/gpg2")
>
> May be you need to update your gpg.
>
> It would be neat to have a thing that checklisted all your certificate 
> handling components are working correctly.
>
> My be you could point eww to the https address for the packages and see if 
> your emacs can get thru to there.>
>

The version of gpg2 on Slackware is quite old, so I tried the
following .emacs on Fedora 30 (which has a much newer gpg2) running
inside a Docker container

(setq epg-gpg-program "/usr/bin/gpg2")
(setq package-archives '(("gnu" . "https://elpa.gnu.org/packages/";)))

but no joy.

Is there a way I can get Emacs to tell me how it's downloading the
file and how it's running gpg2 to verify it? I'd like to try the same
outside Emacs to see if I can reproduce the problem.

In any case, I found this bug:
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=35534, so maybe we just
have to wait and see what the maintainers find.

Best,

Nicky