Emacs: Failed to verify signature archive-contents.sig

Question

Recently tried to update emacs packages and got this.

Failed to verify signature archive-contents.sig:
No public key for 066DAFCB81E42C40 created at 2019-10-02T10:10:02+0100 using RSA
Command output:
gpg: Signature made Wed 02 Oct 2019 10:10:02 AM BST
gpg:                using RSA key C433554766D3DDC64221BFAA066DAFCB81E42C40
gpg: Can't check signature: No public key

Any ideas why?

Emulous

Answer 1

See https://emacs.stackexchange.com/questions/233/ for the same question.

The signature check failed because you don't have the new key (the old signature key expired on Sep 23). The new key is available from the usual GPG key-servers, comes with Emacs≥26.3, and can also be obtained by installing the package gnu-elpa-keyring-update.

Denyse

I see that the options are either disable signature verification (that I obviously do not want to do) or download package that do it for me. Is it possible just import the new keys to gpg without installing side dependencies? – Emulous

well i see this error when i tried to install "Failed to verify signature: "gnu-elpa-keyring-update-2019.3.tar.sig" – Inadequate

@Inadequate Did you also try the option to update manually with gpg? Currently gpg --homedir ~/.emacs.d/elpa/gnupg --receive-keys 066DAFCB81E42C40 (see the package’s website) – Goods

@papachan, see the README of gnu-elpa-keyring-update which offers workarounds. – Prong

@SimonA.Eugster the command gives me gpg: Invalid option "--receive-keys" – Pyroxenite

@Pyroxenite Funny. I'm not a gpg expert, but 2.2.19 lists this option in the help output (gpg --help). Are you using an older version? – Goods

@SimonA.Eugster yes, it turned out I used an outdated version – Pyroxenite

got gpg: keyserver receive failed: General error on gpg --receive-keys. No way to install gnu-elpa-keyring-update neither. – Policeman

I have followed the same steps and I also get the "General error" message as @Policeman – Otherness

Got the same 'General error', so tried the 'modify expiration date', but got: gpg: "474F05837FBDEF9B" is not a fingerprint. For now I guess its 'temporarily disable signature verification'. – Scharf

I get that failure with 27.2… – Barbell

This fix does not work since you need the correct signature to install the new signature – Fidel

@SimonA.Eugster your fix was the only fix that worked for me, thanks – Fidel

yeah, gnu-elpa-keyring-update can not be installed if elpa is not working in the first place. – Nianiabi

Answer 2

Try renaming your ~/.emacs.d/elpa/gnupg file to something else as a backup and then run M-x package-refresh-contents. This is what worked for me.

Zebe

Did not work for me, get the same error – Fidel

(bad-signature "archive-contents.sig") – Handy

It did work for me (emacs 28.2) - I didn't need to rename gnupg either. – Calctufa

Answer 3

I got a similar error in Windows 10 including the following line

gpg: keyblock resource '/c/Users/<theuser>/c:/Users/<theuser>/.emacs.d/elpa/gnupg/pubring.kbx': No such file or directory

It turned out that Emacs was using the GnuPG installed via MSYS2. Installing the Windows version of GnuPG (Gpg4win) solved it.

Triarchy