Re: ELPA security

[Stephen J. Turnbull]

Ted Zlatanov writes:

 > 3. we may need a way to revoke a signed commit.  Perhaps it can simply
 > be a revert of the previously committed "bad" code, followed by another
 > commit, instead of a full revocation process.

Branches.  It should be possible for a package.el implementation to
call home to the original GNU ELPA and check on the status of the most
recent signed commit.