Daniel Mendler <[email protected]> writes: >>> https://github.com/minad/doom-on-emacs/blob/9d5929335c4080699a2daa153ace2996c905008a/Makefile#L17 >>> >>> This way you would get similar guarantees. >> >> That would correspond to setting `package-check-signature' to t in the patch. > > No, that's not exactly the same. An attacker who compromises the ELPA > build server can distribute a manipulated tarball with a valid > signature. You are protected against this if the valid hash is > hard-coded in the download script. But of course in such a scenario we > would have bigger problems since the ELPA repositories might have been > compromised as well.
Well. I do not think that we should go that far in being paranoid. If ELPA is compromised, we are doomed anyway. IMHO, the increase of maintenance burden by the need to keep sha up to date is not worth it. And if ELPA can be compromised, so is savannah. -- Ihor Radchenko // yantar92, Org mode maintainer, Learn more about Org mode at <https://orgmode.org/>. Support Org development at <https://liberapay.com/org-mode>, or support my work at <https://liberapay.com/yantar92>
