Re: package.el + DVCS for security and convenience

[Stefan Monnier]

> Maybe `vc-dir' already has code to do this, so package.el can simply
> ride on top of it.

I'm afraid VC does not have much of that code yet.

An alternative is to only protect the communication between elpa.gnu.org
and the end client: add a "GPG signature" to each entry of the
`archive-contents' file, so they can be checked after the download.


        Stefan