Re: cannot download packages from elpa

[Stefan Monnier]

> Is key expiration not par for the course?  It's not clear what could have been
> done differently.

I hope we'll have an answer to that before the next expiration (in 2024).
For me, it's something like:

- arrange for gnu-elpa-keyring-update to be pre-installed (and if
  needed, extra tricks in package.el to encourage the user to update it
  when it's out of date).  So at least any user using M-x package-refresh
  would get a chance at discovering that there's an update pending.

- Create new keys more frequently (e.g. I plan at rolling out a new
  signing key in 2 years or so) so by the time a key expires, your Emacs
  already came with a newer key if it's recentish (compared to the new
  key only appearing in Emacs-26.3, less than a month before the
  previous key expired).

> The tragedies are emacs's outmoded packaging tools, and

Being myself outmoded I don't know what is outmoded about package.el.

Unless by "outmoded" you mean "makes efforts to protect privacy", in
which case I do see what you mean, such as the fact that Emacs
doesn't automatically check for updates by contacting some server
every time you launch it.

On this front, I've been thinking that maybe we could try some steps in
the "less outmoded" direction along the lines of:
- keep track of the last time we refreshed the local copy of the
  archive-contents metadata.
- if it's older than N months, upon startup, emit a message
  encouraging/reminding the user to refresh it.
Along the same lines, when the local copy of the archive-contents
metadata indicates that one of your packages is out of date, we could
emit a message encouraging/reminding the user to upgrade it.

> elpa's inscrutability.

Not sure if you're talking about ELPA the infrastructure/protocol or
about GNU ELPA in particular, but in either case, I'll be more than
happy to try to explain, especially if that can lead to someone helping
me out with GNU ELPA, where I feel much too often quite lonely
(additionally to feeling inadequate because it's really not my area of
expertise).


        Stefan