Re: ELPA security

[Ted Zlatanov]

On Sun, 16 Jun 2013 19:12:02 -0400 Stefan Monnier <address@hidden> wrote: 

>> * add `package-signed-archives', a list of logical archive names with
>> default '("gnu").  Add `package-archive-signed-p' to check it.

SM> I'd opt for the opposite, i.e. list the archives that aren't signed.

SM> And maybe automatically eliminate an archive from that "not signed"
SM> list if we ever find a signature in it.

How about basing the decision on the existence of
etc/elpa/ARCHIVE-NAME.signed which can then tell us more about the way
the archive is signed without customizing ELisp code?  Like a Yum or APT
repository description you can drop in?  I could use it to automatically
augment `package-archives' if you think that's useful, so it becomes
very manageable for a whole site.

>> If you're OK with the code changes I'll get them working and start
>> implementing `package--verify-signature'.

SM> Go ahead,

OK, thanks for the review.

Ted