Expiring package metadata is done by checking the timestamp in package
archive file.  This is intended to limit the effectiveness of a replay
attack.  The onus is on the package archives to implement a secure and
reasonable policy.  (Debian uses 7 days before metadata expires.)

Together with package checksums, this adds sufficient protection
against metadata replay attacks.  (Bug#19479)

* lisp/emacs-lisp/package.el (package-check-timestamp): New defcustom.
(bad-timestamp): New error.
(package--parse-header-from-buffer)
(package--parse-valid-until-from-buffer)
(package--parse-last-updated-from-buffer)
(package--archive-verify-timestamp)
(package--archive-verify-not-expired)
(package--compare-archive-timestamps)
(package--check-archive-timestamp): New defuns.
(package--download-one-archive): Check timestamp of the
'archive-contents' file using above functions.  It is only checked if
it exists, which makes this change backwards compatible.

* lisp/calendar/iso8601.el (iso8601-parse): Add autoload cookie.

* test/lisp/emacs-lisp/package-tests.el
(package-test-parse-valid-until-from-buffer)
(package-test-parse-last-updated-from-buffer)
(package-test-archive-verify-timestamp)
(package-test-check-archive-timestamp)
(package-test-check-archive-timestamp/not-expired)
(package-test-check-archive-timestamp/expired): New tests.

* test/lisp/emacs-lisp/package-resources/archives/older/archive-contents:
* test/lisp/emacs-lisp/package-resources/archives/newer/archive-contents:
New files.

* doc/lispref/package.texi (Package Archives, Archive Web Server):
Document how to increase the security of a package archive using
checksums, signing and timestamps.

Package checksum verification is the first step towards protecting
users of package.el against replay attacks.  Signing individual
packages still allows a hostile actor to distribute an out-of-date
package containing a known security defect.  To avoid that, we need to
distribute signed package metadata (the ELPA "archive-contents" file)
and checksums for the individual packages together.  (Bug#19479)

A subsequent patch will add support for last-update and expiration
timestamps in "archive-contents", without which the protection against
replay attacks will be largely ineffective.

Taken together, this feature will make signing individual packages
obsolete.  We will instead rely on signing the metadata, package
checksums and timestamps.  Note that individual package signatures
should still be distributed for a long time still to support old
versions of Emacs.

For more on replay attacks, see:
https://www2.cs.arizona.edu/stork/packagemanagersecurity/attacks-on-package-managers.html

* lisp/emacs-lisp/package.el (package-verify-checksums): New
defcustom.
(package-desc, package--ac-desc)
(package--add-to-archive-contents, package-install-from-archive): New
fields 'size' and 'checksums'.
(package-desc-filename): New function.

(package-error): New error type.
(bad-signature): Inherit from error type 'package-error'.
(bad-checksum, bad-size): New error types.
(package-insecure-hash-algorithms): New constant.
(package--verify-package-checksum)
(package--verify-package-size): New function to verify that the
checksum and size of a package corresponds to the checksum and size
data in the "archive-contents" file on the package archive.
(package--show-verify-checksum-error): New function to show
details of an error on checksum verification.

* lisp/emacs-lisp/package-x.el (package-upload-buffer-internal):
Update to use above new fields 'size' and 'checksums'.

* test/lisp/emacs-lisp/package-tests.el (package-test-refresh-contents)
(package-test-install-single-from-archive)
(package-test-list-filter-by-archive)
(package-test-list-filter-by-status): Update tests.
(with-install-using-checksum): New macro.
(package-test-install-wrong-size-single)
(package-test-install-wrong-size-tar): New tests for size checking.
(package-test-install-with-checksum/single-valid)
(package-test-install-with-checksum/single-invalid)
(package-test-install-with-checksum/tar-valid)
(package-test-install-with-checksum/tar-invalid): New tests for
installing packages with checksums.
(package-test-verification-text)
(package-tests-valid-md5-checksum)
(package-tests-valid-sha256-checksum)
(package-tests-valid-sha512-checksum): New variables.
(package-tests--run-verify-checksums-test): New macro.
(package-test-verify-package-checksums-nil/ignore-invalid)
(package-test-verify-package-checksums-allow-missing)
(package-test-verify-package-checksums-allow-missing/missing)
(package-test-verify-package-checksums-allow-missing/ignore-unsupported)
(package-test-verify-package-checksums-t)
(package-test-verify-package-checksums-t/invalid-fails)
(package-test-verify-package-checksums-t/missing-fails)
(package-test-verify-package-checksums-all)
(package-test-verify-package-checksums-all/invalid-fails)
(package-test-verify-package-checksums-all/missing-fails)
(package-test-verify-package-checksums-all/no-supported-hash-fails)
(package-test-verify-package-checksums-all/ignore-unsupported)
(package-test-verify-package-size): New tests for the checksum
support.

* test/lisp/emacs-lisp/package-resources/archive-contents:
* test/lisp/emacs-lisp/package-resources/checksum-invalid-1.0.el:
* test/lisp/emacs-lisp/package-resources/checksum-valid-123.el:
* test/lisp/emacs-lisp/package-resources/checksum-valid-tar-0.99.tar:
* test/lisp/emacs-lisp/package-resources/checksum-valid-tar-0.99.tar:
New test data files.

* doc/emacs/package.texi (Package Installation): Document package
checksum checking.
* etc/NEWS: Announce it.

* doc/lispref/help.texi (Help Functions): Mention help-form for
read-char-from-minibuffer and y-or-n-p.

* doc/lispref/minibuf.texi (Yes-or-No Queries): Mention help-form
for y-or-n-p.
(Multiple Queries): Mention help-form for read-char-from-minibuffer.

* lisp/files.el (find-file-noselect): Let-bind multi-line help text
to help-form for y-or-n-p.

* lisp/subr.el (read-char-choice): Mention help-form in docstring.
(read-char-from-minibuffer): Mention help-form in docstring.
(y-or-n-p-map): Remove handling of 'help'.
(y-or-n-p): Mention help-form in docstring.
When help-form is non-nil: add help-char to 'prompt', and bind
help-char to help-form-show in composed-keymap.

* doc/lispref/os.texi (System Environment): Add `path-separator'
function and `null-device' variable and function.

* etc/NEWS: Mention 'null-device' and 'path-separator'.  Fix typos.

* lisp/files-x.el (path-separator, null-device): New defuns.  (Bug#3736)

* lisp/net/tramp-adb.el
(tramp-adb-connection-local-default-shell-variables): Rename from
`tramp-adb-connection-local-default-profile'.

* lisp/net/tramp-integration.el
(tramp-connection-local-default-system-variables): New defvar.
Add it to connection-local profiles.
(tramp-connection-local-default-shell-variables): Rename from
`tramp-connection-local-default-profile'.

* lisp/progmodes/grep.el (grep-hello-file): New defun.
(grep-compute-defaults): Use `null-device' function for remote
case. Handle remote `hello-file'.  Use `process-file-shell-command'.
(grep,grep-expand-keywords, lgrep): Use `null-device' function for
remote case.

* lisp/cus-edit.el (custom--filter-obsolete-variables): New defun.
* lisp/cus-edit.el (customize-changed-options)
(customize-apropos, custom-group-value-create): Hide obsolete user
options.  (Bug#44598)
* test/lisp/cus-edit-tests.el: New file.

This was problematic when minibuffer-follows-selected-frame was non-nil.
Introduce a new parameter DONT-SET-FRAME to set-window-configuration.

* doc/lispref/windows.texi (Window Configurations): Describe the new &optional
parameter to set-window-configuration.

* etc/NEWS (Lisp Changes): Note the new parameter to set-window-configuration.

* src/keyboard.c (read_char_help_form_unwind): Add a new Qnil argument to the
call of Fset_window_configuration.

* src/minibuf.c (read_minibuf): Cons up a Qt with the window configuration in
the argument to record_unwind_protect for the window configuration (twice).

* src/window.c (Fset_window_configuration): Add the new &optional parameter
and document it in the doc string.  At the final do_switch_frame operation,
restore the original frame when DONT-SET-FRAME is non-nil.
(restore_window_configuration): Handle the new parameter when the supplied
argument is a cons.

* lisp/emacs-lisp/package.el (package-menu-filter-by-description):
(package-menu-filter-by-name-or-description): New commands to filter
the package menu.  (Bug#44699)
(package-menu-mode-map): Bind the above new commands.
(package-menu-mode-menu): Add new commands to the menu.
* doc/emacs/package.texi (Package Menu): Document new commands.

* lisp/textmodes/bibtex.el (bibtex-unify-case-convert): New
variable (bug#44614).
(bibtex-format-entry): Use it (bug#44614).

75723ec212 (origin/emacs-27) ; * lisp/emacs-lisp/benchmark.el (benchm...
53e2a612ad ; * lib-src/make-fingerprint.c: Update commentary.
286c632772 Reformat argument commentary in etags.c
4ec740866a Make the invocation of combine-change-calls in comment-reg...
66bcec8838 * lisp/progmodes/cc-langs.el (c-<>-notable-chars-re): Fix ...
03eeab469e ; Update the expected result files in test/manual/etags.
d875a22bc6 Update the various INSTALL files

# Conflicts:
#	INSTALL