bug#17625: 24.4.50; All installed packages marked "unsigned", no archive listed

[Ted Zlatanov]

My test report from the emacs-24 branch:

Everything worked smoothly with GnuPG 1.x installed (install signed
package load-dir from the GNU ELPA; fail unsigned package
typing-practice from marmalade). It was a very nice experience! I didn't
try corrupting archive-contents or package contents.

When I intentionally broke GnuPG (made /usr/bin/gpg a copy of
/bin/false) the errors were reasonable.

The homedir, defaulting to `/home/tzz/.emacs.d/elpa/gnupg' in my case,
was created with 755 permissions and GnuPG rightly complained:

gpg: WARNING: unsafe permissions on homedir `/home/tzz/.emacs.d/elpa/gnupg'

I didn't make the necessary change but it's trivial.

I would make `package-check-signature' a radio instead of a dropdown
choice, since there are only three possibilities and it's nice to see
them all at once.  Otherwise the user has to click on the dropdown to
see them.

I hope that's helpful. I can make the two changes suggested above if you
wish. I also feel it is very reasonable to set `package-check-signature'
to t (if GnuPG is installed) in the next release, because the experience
is so seamless.  But at least for myself, I'm happily setting it to t now.

I think it would be nice for new users to explain a little more about
this new feature and process in packages.texi or in the main manual.

Thanks for your patience
Ted