Re: [ELPA/elpa-admin] Render README.org as ASCII with ox-ascii

[Adam Porter]

Clément Pit-Claudel <cpitclaudel@gmail.com> writes:

> The scary part is not so much altering a package (or a few packages)
> with bad code (though that is scary), but having the ability to alter
> all of them (sure, you could push to all package branches, but that's
> more easily detected that altering one readme).

Yes, we should be very careful about that, and I'm glad people like you
and Stefan are keeping it in mind.  :)  In fact...

>> Also, AFAIU, ELPA already runs Makefiles for packages as part of the
>> build process, and those can run arbitrary code, which I guess could do
>> things like modify other packages, modify the build process or scripts,
>> or anything else that the user account the build process runs as could
>> do on the server.
>
> Good catch, and indeed given this running org doesn't make things
> worse.  Thanks.

As Stefan mentioned, it appears that he's is way ahead of both of us, as
he's already implemented some sandboxing in the build process.  :)