Ihor Radchenko <[email protected]> writes: > Daniel Mendler <[email protected]> writes: > >> If the code is downloaded as tarball, I strongly recommend to check it >> against a sha256 hash. See for instance: >> >> https://github.com/minad/doom-on-emacs/blob/9d5929335c4080699a2daa153ace2996c905008a/Makefile#L17 >> >> This way you would get similar guarantees. > > That would correspond to setting `package-check-signature' to t in the patch.
No, that's not exactly the same. An attacker who compromises the ELPA build server can distribute a manipulated tarball with a valid signature. You are protected against this if the valid hash is hard-coded in the download script. But of course in such a scenario we would have bigger problems since the ELPA repositories might have been compromised as well. Daniel
