Re: GNU ELPA security and Org-mode

[Stefan Monnier]

> - I create a branch on elpa.git called "externals/org".

Right.

> - I create the "elpa/packages/org" directory in this branch.

No.  It should contain the same files with the same names as the
tarball would.

> - I copy the content of an Org ELPA archive (eg org-20180430.tar)
>   into this directory, with org-{version|pkg|loaddefs}.el files.

Yes, except for org-pkg.el (the corresponding info should be in org.el
instead).

> - I commit and publish this "externals/org" branch on the public
>   elpa.git repository.
> Is that so?

Yup,


        Stefan