Re: feature/package+vc 04c4c578c7 3/4: Allow for packages to be installed directly from VCS

[Lars Ingebrigtsen]

Philip Kaludercic <philipk@posteo.net> writes:

> It seems to me that fetching a package from source is no more dangerous
> than fetching a tarball, seeing as the tarball is automatically
> generated from the repository.

It doesn't matter much whether it's a tar ball or a git repo (although
there is signing of the tar balls), but whether there's any oversight at
all or not.  All commits to Non/GNU ELPA end up on a mailing list, which
provides a smidgen of transparency, which is better than none.