bug#17625: 24.4.50; All installed packages marked "unsigned", no archive listed

[Ted Zlatanov <tzz@lifelogs.com>]

On Sat, 31 May 2014 17:28:16 -0400 Glenn Morris <rgm@gnu.org> wrote: 

GM> Stefan Monnier wrote:
>> I guess we could move the archive-generation process to another machine,

GM> I won't pretend to know what I'm talking about, but I think that's the
GM> kind of thing you have to do if this is to have any real value.

I suggested to Stefan and on emacs-devel that the signing process should
be manual and after review. That's how it works for Debian, for
instance. The concern from several people was that this would be hard on
the GNU ELPA maintainers. I think it's still worth doing, especially if
the task can be delegated and contributors are required to sign their
Git commits.

GM> And for an inherently-not-very-secure environment like Emacs, is it worth it?

I think so.  These packages can run arbitrary code and Emacs makes it
very easy to install them.

>> AFAIK we currently use http://elpa.gnu.org/packages/, so no SSL
>> involved.

GM> Right. Will it Just Work to change that to https?

>> I don't enough about SSL certs to be sure whether it would provide
>> comparable guarantees to signed packages.

GM> I think SSL would verify that you are talking to the server that you
GM> thought you were talking too, and that no-one had injected anything in
GM> between you and it. Which is all that gpg-signed packages would do, if
GM> the machine that hosts the packages also does the signing (AFAICS).

The file, the signature, and the GNU ELPA maintainers' public key have
to match; MITM attacks can't subvert that AFAIK.

Ted