Default :url to pass assertion in security check

[rodentrabies]

Not sure if this is acceptable solution, but since url is ignored for elpa method, it can be defaulted to something like "https://insecure", as for emacswiki for example. Fixes #2467.

[npostavs]

I think we should check the package's archive URL, which should be:

(cdr (or elpa-repo
         (assoc (package-desc-archive (cadr (assq package package-archive-contents)))
                package-archives)))

[npostavs]

(24.3 and 23.4 test logs)

methods/el-get-elpa.el:323:1:Error: the function package-desc-archive' is not known to be defined.`

Ah, we need a different expression for older package.el versions.

[rodentrabies]

Yep, I thought it was changed like package-desc-doc etc, so I tried to google old (pre 24.4) name, but it seems like there was no such function.

[rodentrabies]

Will try to solve this in a couple of hours.

[dsedivec]

I think we should check the package's archive URL, which should be:

(cdr (or elpa-repo
         (assoc (package-desc-archive (cadr (assq package package-archive-contents)))
                package-archives)))

Thanks! Just a heads up: I packaged this into advice around el-get-elpa-install and it seems that I got passed a string for the PACKAGE parameter, rather than a symbol, which caused (assq package package-archive-contents) to return nil. This happened when installing moinmoin-mode required screen-lines. I changed that to (assq (el-get-as-symbol package) package-archive-contents).

In case anyone is interested, here's the advice I ended up with (which, as stated above, still only works in 24.5):

(defun my:el-get-secure-url-patch (orig-fun package url &rest args)
  (apply orig-fun
         package
         (cdr (or (el-get-elpa-package-repo package)
                  (assoc (package-desc-archive
                          (cadr (assq (el-get-as-symbol package)
                                      package-archive-contents)))
                         package-archives)))
         args))

(advice-add 'el-get-elpa-install :around #'my:el-get-secure-url-patch)

(I made advice rather than patching el-get so I can keep upgrading el-get.)

[npostavs]

In case anyone is interested, here's the advice I ended up with (which, as stated above, still only works in 24.5):

Note this fails if package-archive-contents hasn't been initialized yet. #2474 (comment)

[npostavs]

Okay, turns out there is already package-archive-base which we can use, though of course it's not entirely compatible across versions, see #2477.