Error updating emacs packages: Failed to download 'gnu' archive

Question

My init.el uses this to initialize packages:

(package-initialize)
(add-to-list 'package-archives '("gnu" . "http://elpa.gnu.org/packages/"))
(add-to-list 'package-archives '("melpa" . "http://melpa.milkbox.net/packages/"))
(add-to-list 'package-archives '("melpa-stable" . "http://melpa-stable.milkbox.net/packages/"))

When I do M-x package-refresh-contents I get the following error: Failed to download `gnu' archive.

M-x toggle-debug-on-error gives me this stacktrace:

Debugger entered--Lisp error: (error "Failed to verify signature archive-contents.sig: (\"No public key for 474F05837FBDEF9B created at 2014-09-29T07:20:03-0700 using DSA\")")
  signal(error ("Failed to verify signature archive-contents.sig: (\"No public key for 474F05837FBDEF9B created at 2014-09-29T07:20:03-0700 using DSA\")"))
  error("Failed to verify signature %s: %S" "archive-contents.sig" ("No public key for 474F05837FBDEF9B created at 2014-09-29T07:20:03-0700 using DSA"))
  package--check-signature("http://elpa.gnu.org/packages/" "archive-contents")
  package--download-one-archive(("gnu" . "http://elpa.gnu.org/packages/") "archive-contents")

Is this a problem with my configuration, and how would I fix it?

Solution 1

Looks like a bug in your version of Emacs. You can probably circumvent it by setting package-check-signature to nil.

Solution 2

This is not an error caused by misconfiguration but is due to the change of the file package-keyring.gpg from Emacs 26.3. As stated from the release note:

New GPG key for GNU ELPA package signature checking.

I believe the newer packages from GNU ELPA repository are signed for this new keyring to check.

The simple way to fix it is to upgrade to Emacs 26.3.

But if you were like me, who don't bother to upgrade, you can download the package-keyring.gpg file from here and put it in the etc/ directory under your Emacs installation location. In my case, it is /usr/local/share/emacs/26.1/etc/package-keyring.gpg. It might be different locations for different installation methods (apt, yum, etc.) on various platforms (macOS, Windows, etc.).

Alternatively, you can try to install the package gnu-elpa-keyring-update to automatically update the keyring in the future.

Solution 3

For anyone else that doesn't have the signature problem, try to initialise package

M-x package-initialize

Solution 4

My issue was that I was missing gpg (gnupg).

On OSX I solved this by using brew install gpg.

View more solutions

Comments

[yayitswei]

I'm on Version 24.3.50 (9.0). Would upgrading Emacs help? Is there a newer downloadable build for Mac OS X?

[Stefan]

24.3.50 means "some snapshot of the code during the development of 24.4". We moved on to 24.3.90 around april, so your snapshot is ancient by now (a snapshot older than a month is already "old") and deserves to be retired.

[yayitswei]

On 24.3.93 and it works great now, thank you! No more scary red "UNSIGNED" tags in the package list.

[alvaropg]

Here same problem with emacs-24.4 in Fedora 21

[Stefan]

The code should work just fine without gpg (it will just skip checking the signatures), so this is still a problem that needs to be solved. If you can reproduce it, please M-x report-emacs-bug providing as many details as you can.

[DomQ]

Bug is #19409 (lists.gnu.org/archive/html/bug-gnu-emacs/2014-12/msg00781.h‌​tml); if I understand correctly ELPA has been broken since September, 2014 (at least) because some joker signed a package with a key that they didn't publish... And nobody seems to care.

[xhh]

had the same issue and fixed it by upgrading emacs - used emacs 24.3 before, upgraded to github.com/railwaycat/emacs-mac-port (emacs 24.5.1 for now) and the issue is gone

[sds]

this is a problem with elpa, not with emacs

[xdavidliu]

this was the only solution to my problem; not installing gnutls, gnupg, changing https to http, or adding a / after packages

[kdb]

Do you by any chance know a solution that works without root privileges?

[Lei Zhao]

Of course, you can install gnu-epla-keyring-update or follow the instructions from the README of that package. But I believe that the effective directory is on ~/.emacs.d/elpa/gnupg.

[jaromrax]

failed to download melpa, failed to download gnu

[charliesneath]

This helped. Does anyone one know what causes the state that is fixed by initializing packages?

[Draif Kroneg]

I am on Emacs 26.3 and I still get this error.