Re: package.el + DVCS for security and convenience

[Ted Zlatanov]

On Mon, 24 Dec 2012 13:55:33 +0100 Bastien <address@hidden> wrote: 

B> Nic Ferrier <address@hidden> writes:

>> Ted Zlatanov <address@hidden> writes:
>> 
>>> I propose to require signatures for ELPA packages and make package.el
>>> aware of signatures:
>> 
>> Requiring signatures would be VERY bad at this stage because you would
>> break all the repositories that people get code from that do not support
>> signing.

B> I may be wrong but I think Ted's suggestion is not for all repository
B> but for GNU ELPA, in which case I think it makes sense.

Right.  I think any ELPA repositories that are not the GNU ELPA will
quickly switch over, however, because it makes a lot of sense and will
be little work on the maintainer end.  The bulk of the work will be in
package.el to support tag/commit signing when it's enabled (through
vc-dir and friends, if possible) and expose it to the user.

Ted