Daniel Mendler <[email protected]> writes: >> It is about forcing people to download code from online resources they >> do not expect. > > This seems a bit artificial as argument. You also have to clone the > repository once in the beginning. The next step would then be to > download dependencies, and if desired this could require a manual > confirmation or a manual invocation of "make download-deps". I am wary > myself of code which pulls in additional code automatically.
Yes, and I like that Morgan's patch does exactly this. Even more robust is having a module, so that people cloning Org know that Org maintainers verified the code they vendor. -- Ihor Radchenko // yantar92, Org mode maintainer, Learn more about Org mode at <https://orgmode.org/>. Support Org development at <https://liberapay.com/org-mode>, or support my work at <https://liberapay.com/yantar92>
