Error updating emacs packages: Failed to download 'gnu' archive

Question

My init.el uses this to initialize packages:

(package-initialize)
(add-to-list 'package-archives '("gnu" . "http://elpa.gnu.org/packages/"))
(add-to-list 'package-archives '("melpa" . "http://melpa.milkbox.net/packages/"))
(add-to-list 'package-archives '("melpa-stable" . "http://melpa-stable.milkbox.net/packages/"))

When I do M-x package-refresh-contents I get the following error: Failed to download `gnu' archive.

M-x toggle-debug-on-error gives me this stacktrace:

Debugger entered--Lisp error: (error "Failed to verify signature archive-contents.sig: (\"No public key for 474F05837FBDEF9B created at 2014-09-29T07:20:03-0700 using DSA\")")
  signal(error ("Failed to verify signature archive-contents.sig: (\"No public key for 474F05837FBDEF9B created at 2014-09-29T07:20:03-0700 using DSA\")"))
  error("Failed to verify signature %s: %S" "archive-contents.sig" ("No public key for 474F05837FBDEF9B created at 2014-09-29T07:20:03-0700 using DSA"))
  package--check-signature("http://elpa.gnu.org/packages/" "archive-contents")
  package--download-one-archive(("gnu" . "http://elpa.gnu.org/packages/") "archive-contents")

Is this a problem with my configuration, and how would I fix it?

Answer 1

Looks like a bug in your version of Emacs. You can probably circumvent it by setting package-check-signature to nil.

Answer 2

My issue was that I was missing gpg (gnupg).

On OSX I solved this by using brew install gpg.

Answer 3

For anyone else that doesn't have the signature problem, try to initialise package

M-x package-initialize

Answer 4

This is not an error caused by misconfiguration but is due to the change of the file package-keyring.gpg from Emacs 26.3. As stated from the release note:

New GPG key for GNU ELPA package signature checking.

I believe the newer packages from GNU ELPA repository are signed for this new keyring to check.

The simple way to fix it is to upgrade to Emacs 26.3.

But if you were like me, who don't bother to upgrade, you can download the package-keyring.gpg file from here and put it in the etc/ directory under your Emacs installation location. In my case, it is /usr/local/share/emacs/26.1/etc/package-keyring.gpg. It might be different locations for different installation methods (apt, yum, etc.) on various platforms (macOS, Windows, etc.).

Alternatively, you can try to install the package gnu-elpa-keyring-update to automatically update the keyring in the future.

Answer 5

I installed emacs on Arch Linux, opened it, ran package-refresh-contents and got this issue. After a while, I realized I had no init file. If this is your case, create your init file with emacs ~/.emacs.d/init.el and then add the following content:

(package-initialize)
(add-to-list 'package-archives '("gnu" . "http://elpa.gnu.org/packages/"))
(add-to-list 'package-archives '("melpa" . "http://melpa.milkbox.net/packages/"))

Save it with C-x C-s and run package-refresh-contents again. This time it will work.