Re: ELPA security

[Tom Tromey]

>>>>> "Ted" == Ted Zlatanov <address@hidden> writes:

Ted> 1. add DVCS support to package.el, supporting Git and Bazaar, with the
Ted> notion of "pull packages from repo X at tag/commit Y" in addition to the
Ted> current "pull packages from URLs".  The VC package has to be involved
Ted> here, instead of writing custom code.

What is the reason for this?

FWIW, I considered and rejected this approach when writing package.el.
My reason was that I wanted packaging not to require any external tools,
so it would be available to all Emacs users.  Also, KISS.

Mixing in VC seems to add a lot of potential failure modes.

Tom